Cryptocurrency exchange Binance has revealed that hackers used elaborate social engineering tactics, including fake job interviews and compromised internal AI tools, to orchestrate the record-breaking $6.34 billion cyberattack.
The security breach, which took place on October 29, allowed malicious actors to infiltrate hot wallet infrastructure and drain billions in digital assets across multiple blockchains. According to initial investigative reports released by Binance, the multi-stage campaign began months prior.
In June, an engineer inadvertently downloaded a tampered installer, and by September, hackers posing as recruiters engaged another engineer through a legitimate job-hunting platform.
During these bogus video interviews, the perpetrators built trust before instructing the employee to download a coding assignment containing hidden malware designed to evade endpoint security detection. Using that compromised machine, the attackers leveraged internal AI tools to access wallet deployment permissions and execute the breach.
Binance co-CEO Richard Teng detailed the sophisticated progression during an interview on CNBC’s “Squawk on the Street,” rejecting theories of a simple single point of failure:
“In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that,” Teng said.
“In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security… from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorised our wallet transaction.”
Although federal intelligence agencies, including the FBI, have linked the cyber attack to North Korean state-sponsored groups such as TraderTraitor, Binance has focused heavily on immediate containment, asset recovery, and structural remediation.
The platform temporarily suspended withdrawals while working alongside industry partners, such as Tether, Circle, and Ripple, to freeze approximately $3 billion in stolen funds.
Teng confirmed that Binance has set aside funds to cover all losses, successfully replenishing 98% of the affected token assets while acquiring remaining illiquid holdings. Internal networks, wallet systems and AI tools have since been completely rebuilt, credentials rotated and employee devices subjected to enhanced security checks.
“We’re also getting an independent expert to review everything that we have done, and we’ll keep strengthening our defences as the investigation continues,” Teng added. “We’re working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front.”
Discover more from Tech Digest
Subscribe to get the latest posts sent to your email.