Binance ties $6.3bn heist to malware and fake job interviews
Binance says hackers used malware, bogus job interviews and a compromised internal AI tool to drain hot wallets; $2.85bn has been frozen or intercepted.
What you need to know
Binance has detailed how hackers carried out a $6.3bn hot-wallet raid, saying an engineer's inadvertent malware download in June and a fake recruitment process in September enabled the October attack. The exchange says $2.85bn of the drained funds has been frozen or intercepted, and that withdrawals have resumed.
- Binance attributes the record $6.3bn theft to a multi-stage campaign starting with a malware infection in June
- Hackers posed as recruiters on a legitimate job platform, tricking an engineer into downloading malware during a second interview
- The attack used a compromised computer and an internal AI tool on 20 October, with wallet drains triggered on 29 October
- Binance says $2.85bn of the $6.34bn taken has been frozen or intercepted
- The FBI blames North Korea; Pyongyang denies involvement
How the breach unfolded
Binance said the operation began in June when an engineer inadvertently downloaded malware that exposed team roles tied to its cryptowallet infrastructure. A fake project director later approached another engineer on a legitimate job-hunting platform, arranging a video interview with a sham HR representative and a second-round chat with the supposed chief executive of a fictitious company. During that second interview the engineer was tricked into downloading malware.
On 20 October the attacker used the compromised computer and an internal AI tool to seize control of that engineer's system and a second wallet developer's machine. On 29 October the attacker used the second developer's computer, alongside credentials stolen from the first engineer, to trigger a malicious script and launch the raid.
Losses, withdrawals and blame
Binance said $2.85bn of the $6.34bn drained from cryptowallets had been frozen or intercepted. The incident led the exchange to suspend customer withdrawals globally until the service was restored on Sunday. Binance said it had set aside more than 100% of the funds needed to cover the loss and that 98% of affected token assets had been replenished as of Saturday. The company apologised for the disruption and called the breach serious and highly sophisticated.
The FBI has blamed North Korea for the heist. Kim Yo-jong, a senior North Korean official and sister of leader Kim Jong-un, rejected the accusation through state media as absurd rhetoric and a political provocation. Binance cited FBI information in naming North Korea as responsible. The exchange said it would deepen investment in AI threat detection, bring in outside cyber experts for a full review and set up a security research fund.
Has Binance restored customer withdrawals after the hack?
Yes. Binance suspended withdrawals globally after the attack and restored the service on Sunday, saying it had set aside more than 100% of the funds needed to cover the loss.
Sources & context
- Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’ ↗The Guardian
- Binance says fake job interviews used as part of $6.3bn crypto hack ↗BBC News
Something needs correcting? Send a correction.