Binance says hackers used fake job interviews, AI tool to steal $6.3B

Binance says hackers spent months infiltrating its wallet infrastructure before an October 29 attack stole $6.34 billion in crypto. The operation began in June, when an engineer downloaded a tampered installation of a popular AI coding tool after finding it through a search engine. In September, attackers posed as recruiters, interviewed another engineer and sent a coding exercise containing malware designed to evade security measures. They then used access to employees and internal AI tools to breach the system that authorized wallet transactions. Co-CEO Richard Teng disputes the idea that one employee’s laptop was a single point of failure. The FBI has linked the attack to North Korean hackers associated with the TraderTraitor group, though Teng did not directly blame them.

Binance says it has replenished 98% of the affected assets and is still buying back some harder-to-source holdings. The company temporarily restricted certain withdrawals and pledged to cover customer losses; Binance and industry partners have reportedly frozen about $3 billion, while some stolen funds continue to move through laundering channels. Binance says it has rebuilt the wallet system and internal AI tool, replaced compromised devices, revoked related credentials and tokens, and expanded employee-device scans. It is also commissioning an independent security review and working with law enforcement and industry partners to trace and freeze funds. The breach briefly shook confidence in crypto markets, leaving investors to judge whether Binance can restore trust in centralized exchanges.