Binance says fake job interviews, malware led to $6.3bn crypto theft
- Binance says hackers used fake interviews and malware to steal $6.3 billion in crypto on 29 October.
- The FBI blames North Korea; Pyongyang denies it, calling the claim absurd.
- Binance says it has replaced 98 percent of affected assets and $2.85 billion is frozen.
Binance, the world's biggest cryptocurrency exchange, has published its account of how hackers pulled off what is believed to be the largest crypto theft ever: about $6.3 billion taken in roughly four hours on 29 October.
The United States Federal Bureau of Investigation (FBI) has blamed hackers linked to North Korea. Pyongyang has denied it. Kim Yo Jong, sister of leader Kim Jong Un, called the claim "absurd rhetoric", according to Vanguard.
For Nigerian crypto traders, the case is a reminder that the biggest risk on an exchange may not be the market but the security of the platform holding their funds.
How the attackers got in
According to Binance's incident report, the campaign started quietly in June. An engineer downloaded a tampered version of a developer tool while looking for an AI coding assistant. Binance said its security team spotted the problem, replaced the device and changed the engineer's credentials, but the hackers had already gathered information about the engineer and colleagues who worked on wallet systems.
The decisive step came in September. A second engineer, who was job-hunting, was contacted on a legitimate job platform by someone posing as a project director. The attackers set up virtual interviews, with a fake human resources representative sharing social media profiles and photos to look credible, then a supposed chief executive of a company that did not exist.
At the end of the process, the engineer was asked to download a coding assignment onto a work computer. The assignment carried malware hidden in a software development repository. Binance said the code replaced a legitimate development component, ran commands and communicated with an external server while evading security tools.
By 20 October, the attackers had used the compromised machine and an internal AI tool to reach systems belonging to two developers who worked on Binance's wallet infrastructure. Nine days later, using stolen credentials, they ran a malicious script that reached the wallet-signing system, allowing unauthorised transactions across several blockchains, including Bitcoin, Solana and XRP.
Richard Teng, Binance's co-chief executive, said: "This was not a single mistake or a single breach. It was a campaign built over many months."
What happens next
Binance said it has replenished 98 percent of the affected assets from its own funds. The rest involves little-traded currencies that are harder to buy. About $2.85 billion of the stolen funds has been frozen, meaning the attackers cannot move or convert it, the company said.
The damage to confidence is still visible. Data from analytics firm Kaiko showed Binance's share of spot trading among the top 10 platforms fell to about 42 percent in the seven days after the theft, from about 48 percent before it. Net outflows topped $7 billion at first, though deposits have since overtaken withdrawals again. Binance's assets under custody stood at about $157 billion after the theft, withdrawals and market movements.
Binance has not said artificial intelligence caused the breach. Its report says attackers used a compromised machine alongside an internal AI tool to reach more developer systems — a warning for firms adding AI tools faster than they secure them.
