UPDATE: Binance Says Fake Job Interview Opened Door to $6.3 Billion Hack

Binance says attackers used a fake job interview, compromised employee computers and an internal artificial intelligence tool to reach the systems behind last week's $6.3 billion cryptocurrency theft.

As reported earlier, the FBI blamed North Korean hackers for the attack. North Korea has denied responsibility. The new account from Binance describes how the attackers worked for months before the funds were taken on Oct. 29.

According to the exchange, one engineer downloaded a tampered software package while searching for an AI tool in June. Binance detected that incident, replaced the device and changed credentials, but the employee's role and colleagues on the wallet team had been exposed.

In September, another engineer went through what appeared to be a legitimate recruiting process, including video interviews. A supposed company executive then asked the engineer to download a coding assignment. Binance says it contained malware that compromised the work computer.

The attackers later used that computer and an internal AI tool to reach two wallet developers' systems. Stolen credentials were then used to run a malicious script and move funds out of the exchange.

Binance said it has replenished about 98% of affected tokens with company funds and that approximately $2.85 billion in assets has been frozen. The company says users will not bear the losses and that independent cybersecurity experts will review the incident.

The findings are Binance's account of its investigation, not an independent forensic conclusion.