- Published on
Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist
- Authors
- Name
- DeepHorus
Binance has blamed the largest crypto theft on record—$6.3 billion—on a months-long campaign combining fake job interviews with an internal AI tool, according to a company postmortem. The intrusion began in June, when a developer downloaded a tampered installer spread through a malicious Google ad, exposing details about engineers and their methods.
In September, another engineer was targeted by someone posing as a recruiter. The attacker arranged calls and interview rounds, shared social media pages to build trust, and sent a fake assignment that was malware. Binance said its security teams detected the first malware in June and replaced the affected device.
The second attack went unnoticed. The malware deleted the pyenv executable and replaced it with a malicious version that provided backdoor access. Binance described obfuscation and evasion, including swapping a legitimate development tool component to run commands and contact an attacker-controlled server; the zero-day malware was not detected by endpoint protection.
By October 20, attackers the FBI identifies as North Korean unit TraderTraitor used Binance’s internal AI tool to control wallets tied to the first engineer and a third employee. On October 29, they logged into the third employee’s computer and launched the attack. Unauthorized transfers began two hours before Binance stopped them; because the hot wallet used Multi-Party Computation, no single private key could revoke the malicious EIP-7702 authorizations.
CEO Richard Teng said no user is bearing the loss. About $2.85 billion in stolen assets were frozen or intercepted, 98% of impacted tokens have been replenished, and withdrawals have broadly resumed. Binance said it prevented 57 suspected North Korea-linked cases.
Still unclear is why the attack succeeded and how the internal AI tool helped. Fake interviews requiring code downloads have been warned about for years. Binance did not disclose why the tool could be abused.
