- Published
Hackers who stole a record $6.3bn (£4.7bn) from Binance used fake job interviews and a compromised internal AI tool, the firm has revealed.
asserted
firm → publish → interviews
Initial findings published by the company, which operates the world's largest cryptocurrency exchange, said hackers gained access to its systems through "sophisticated, multi-stage campaign".
asserted
hackers → publish → campaign
It said they used a range of techniques such as malicious software downloads to compromise the computers of Binance engineers and gain control over tools to drain its wallet of billions of dollars worth of crypto.
asserted
they → say → crypto
Binance called it a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened".
asserted
this → call → it
In a post on X, external, Binance said hackers targeted its engineers using social engineering techniques.
asserted
hackers → say → techniques
These see hackers use approaches such as phishing to trick people into parting with sensitive or personal details, that can then be used to try and access their accounts.
asserted
that → see → accounts
Binance said as part of the hack, one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives.
asserted
one → say → representatives
It said the perpetrators used "more advanced and deceptive" methods to build trust with him, such as sharing social media accounts that contained personal images.
asserted
that → say → images
The engineer in question was instructed to download malware masquerading as an "assignment" during a second interview, that deployed malicious code with "obfuscation techniques" evading detection.
asserted
that → instruct → detection
Binance said hackers then leveraged the engineer's compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops, and execute the next steps of the attack.
asserted
hackers → say → attack
The incident led Binance to suspend withdrawals for customers globally, meaning users could not get their cryptocurrency out of the platform until the service was restored on Sunday.
uncertain
service → lead → Sunday
Customers withdrew billions of dollars worth of assets after it reopened.
asserted
it → withdraw → assets
"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," it said.
asserted
it → apologise → users
The company added it had taken a range of steps following the incident, including working with law enforcement to trace and freeze affected assets.
asserted
it → add → assets
It said it had also set aside more than 100% of the funds needed to cover the loss, noting 98% of the token assets impacted had been "replenished" as of Saturday.
asserted
% → say → Saturday
The record $6.3bn (£4.7bn) attack is thought to be the largest crypto hack to date.
asserted
attack → think → date
North Korea involvement
US crime agencies, including the Federal Bureau of Investigation (FBI) and Secret Service, have been assisting Binance in tracing the crypto taken from the platform's own wallets.
asserted
agencies → include → wallets
The agencies, along with a range of cyber analysts, said that the hack - like similar breaches before it - bore the signs of having been orchestrated by North Korea.
asserted
hack → say → Korea
Pyongyang hit back at the claims on Tuesday, denying it was behind the hack.
Kim Yo Jong, a top Democratic People's Republic of Korea official and the sister of leader Kim Jong Un, said on the accusations were another "sinister attempt" by the US to damage North Korea's public image.
uncertain
attempt → hit → image
The country has consistently denied being behind a number of major cyber attacks it has been blamed for in recent years.
asserted
it → deny → years
The TraderTraitor unit, which is also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.
asserted
which → know → 2025
Binance had previously not responded to the BBC's queries about North Korea's alleged involvement in the hack.
asserted
Binance → respond → hack
But on Tuesday, the company wrote in its post on X, external: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."
asserted
Republic → write → incident
As part of its security efforts following the attack, Binance said it would also increase investment in AI tools that can detect security threats, as well as engage third-party cyber experts to carry out a full-scale review of the incident.
asserted
that → follow → incident
It also said that it would seek to stablish a security research fund and work with leading AI and security firms on targeted initiatives.
asserted
it → say → initiatives
The Aporia
