Binance reveals hackers used bogus job interviews in record 6.3bn heist

The cryptocurrency sector is grappling with the fallout of the largest digital asset theft in history, after Binance revealed that hackers utilised bogus job interviews, malicious code, and an internal artificial intelligence tool to execute a record-breaking $6.3bn heist.

According to an incident report published by the exchange, the sophisticated operation unfolded in distinct phases over several months. The initial foothold was established in the summer, when a wallet infrastructure engineer inadvertently downloaded tampered software while searching for an AI coding tool. Although security teams detected that early anomaly, replaced the device, and rotated credentials, the initial breach exposed team structures and developer roles to the threat actors.

Media additions

Fake job interviews helped hackers pull off Binance’s record crypto heist

The campaign escalated significantly in September. A second engineer was targeted on a legitimate job-hunting platform by an individual posing as a project director for a fictitious company. The recruitment scam involved a live video interview with a sham human resources representative who shared personal photos and social media profiles to manufacture trust, followed by a second-round interview on a chat application with a purported chief executive. During this second interaction, the programmer was persuaded to download a malicious coding assignment that bypassed endpoint security tools through advanced obfuscation and evasion techniques.

By late October, the attackers leveraged the compromised system alongside an internal AI tool to infiltrate the computers of two additional wallet infrastructure developers. On October 29, the perpetrators utilized stolen credentials and a container deployment token to launch scripts that bypassed normal withdrawal channels, exploiting Ethereum’s EIP-7702 authorization mechanism and multi-party computation architecture to continuously drain hot wallets across multiple blockchains.

While the Federal Bureau of Investigation formally attributed the cyber attack to North Korean state-sponsored units—specifically tracking groups such as TraderTraitor—Pyongyang dismissed the claims. Kim Yo Jong, an influential ruling party official and sister of leader Kim Jong Un, characterized the accusations as absurd rhetoric and a grave political provocation designed to mislead international public opinion, according to state media reports.

In the wake of the breach, Binance temporarily suspended platform withdrawals, prompting customers to withdraw billions of dollars in assets once services reopened. Co-founder Changpeng Zhao noted that navigating the restoration process was hectic, while co-CEO Richard Teng assured users that all customer funds were fully covered and that no individual users suffered direct financial losses. Stablecoin issuers including Tether and Circle assisted in freezing a portion of the illicit transfers, and Binance confirmed it has rebuilt affected wallet systems, decommissioned compromised credentials, and deployed enhanced anomaly detection.

Independent security analysts and industry observers have noted parallels between the Binance infiltration and wider regional campaigns, such as Operation Dream Job and Contagious Interview, which historically target software developers in financial technology sectors.

What to Watch Next

• The progression and final conclusions of the independent cybersecurity review commissioned by Binance.
• Further law enforcement actions regarding the tracking and freezing of remaining unrecovered digital assets.
• Potential regulatory responses concerning developer endpoint security and the internal operational permissions granted to corporate AI tools.