Binance Investigation: North Korean Hackers Planned and Executed $6.3 Billion Digital Currency Theft

Binance Holdings Ltd. said on Tuesday that, in the most detailed investigation report to date, hackers used social engineering techniques, including fake job interviews, as well as malware, to carry out a theft worth as much as $6.3 billion.
Binance blamed North Korea for the hack, saying it involved a “meticulously planned, multi-stage operation.” The report released by the exchange on Tuesday said an engineer was contacted by someone claiming to be a project director through a job recruitment platform. The engineer then took an interview via a social messaging app with someone claiming to be the chief executive of a fictitious company and was asked to download an assignment containing a “malicious codebase.” The report said this triggered a series of unauthorized activities.
“This was not a single mistake or a single vulnerability, but a meticulously planned attack that unfolded over several months,” Binance co-CEO Richard Teng said. The attackers “combined fake job interviews, malware disguised as legitimate developer tools, compromised devices, and artificial intelligence technology.”
Nine days before the hack, the attackers used the laptop of an employee lured into a fake interview to compromise the computers of two other software engineers responsible for developing Binance’s digital wallets. Binance’s report said the hackers used an “internal AI tool” to gain access, but did not specify what the tool was or how it controlled the employees’ laptops.
The report said one of the two engineers accidentally downloaded malware in June, intending to install what Binance called “a popular AI coding tool.” In doing so, they not only exposed the nature of their work but also revealed to the hackers the nature of the work of several other colleagues involved in Binance’s wallet projects.
How the hackers stole billions of dollars from Binance was disclosed as the exchange and the cryptocurrency industry were trying to recover from the largest hack in the history of cyber theft.
The security breach has intensified the cybersecurity crisis, an industry already plagued by cyberattacks. The emergence of artificial intelligence has made matters worse, giving criminals new tools to discover vulnerabilities and deceive employees, while also raising the risks faced by platforms safeguarding billions of dollars in digital assets.
However, law enforcement agencies and security researchers said the techniques used by the hackers to breach Binance were effective strategies commonly used by North Korea. In fact, cybersecurity firm Palo Alto Networks has dubbed this job-interview tactic “infectious interviews.”
Throughout the incident, Binance sought to reassure users, saying it would cover all financial losses. Even so, the exchange suspended withdrawals for nearly two days after the incident. On Sunday morning, Binance began gradually restoring user withdrawals. The company initially experienced hundreds of millions of dollars in outflows, but the situation appeared to stabilize, and by Tuesday Binance reported that hourly deposits had begun to exceed hourly withdrawals.
Binance also said it had largely replenished the cryptocurrency stolen by the hackers, with funding coming from the company’s treasury and two insurance funds.
The cryptocurrency exchange is also working with U.S. law enforcement agencies, including the Federal Bureau of Investigation, the U.S. Secret Service, and the Department of Justice. The FBI intervened shortly after Binance was hacked and has attributed the attack to North Korean hackers.