Hackers Used Fake Job Interviews to Steal $6.3 Billion in Crypto, Binance Says
Binance says a months-long operation used malicious software, fake recruiters and an internal AI tool to reach its cryptocurrency wallets. The FBI blames North Korea, which denies responsibility.
Hackers used bogus job interviews, malicious software and a compromised internal AI tool in the operation that stole about $6.3 billion in cryptocurrency from Binance, the exchange said Tuesday. Co-CEO Richard Teng described a months-long intrusion rather than a single failure involving one employee's laptop, CNBC reported.
According to Binance's account, the attackers first gained a foothold in June when an engineer downloaded a tampered developer tool. The company said it detected suspicious activity, replaced the device and rotated credentials, but the incident exposed information about the engineer and colleagues working on its wallet infrastructure.
A second stage involved fake recruiters approaching another engineer in September. Sham interviews and a coding exercise led the employee to download hidden malware, Teng told CNBC. The Guardian reported that the attackers later used the compromised computer and an internal AI tool to reach another wallet developer's system.
The theft occurred October 29. Binance said $6.34 billion was drained from its cryptocurrency wallets and that about $2.85 billion had been frozen or intercepted, according to The Guardian. Teng separately told CNBC that the exchange had replenished 98% of affected assets and was still purchasing some less-liquid assets. Replenishing balances and freezing stolen funds are different measures, not interchangeable totals.
The FBI has attributed the attack to North Korean hackers linked to the TraderTraitor group. Teng did not independently attribute the operation to North Korea in his CNBC interview. Pyongyang denied responsibility Tuesday, with Kim Yo Jong rejecting the allegations, according to reports citing North Korean state media.
Binance said it had rebuilt the affected wallet system and internal AI tool, replaced compromised devices and retired affected credentials. Teng said an independent expert would review the company's response. The account of how the intrusion unfolded remains Binance's explanation while the investigation and efforts to trace stolen funds continue.