Binance says fake job interviews used in $6.3bn crypto hack

Hackers stole a record $6.3bn (£4.7bn) from Binance, the world’s largest cryptocurrency exchange. The theft was carried out through what Binance called a “sophisticated, multi-stage campaign” that began with fake job interviews. Engineers were targeted via social engineering, with one contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives.

During a second interview, the engineer was instructed to download malware disguised as an assignment. The malicious code used obfuscation techniques to evade detection. Once the engineer’s computer was compromised, the hackers leveraged it and a compromised internal AI tool to gain control over two other engineers’ laptops, ultimately draining Binance’s wallet of billions of dollars in crypto.

Binance suspended withdrawals for customers globally after discovering the breach on Friday. Service was restored on Sunday, and customers subsequently withdrew billions of dollars worth of assets. The company apologised for “the concern, disruption and uncertainty it caused our users, partners and the wider industry.” It said it had set aside more than 100% of the funds needed to cover the loss, and that 98% of affected token assets had been replenished as of Saturday.

Investigation and response

Binance is working with law enforcement, including the FBI and Secret Service, to trace and freeze affected assets. The agencies and cyber analysts said the hack bore signs of having been orchestrated by North Korea. Pyongyang denied involvement, with Kim Yo Jong, a top DPRK official and sister of leader Kim Jong Un, calling the accusation a “sinister attempt” by the US to damage North Korea’s image.

But on Tuesday, Binance posted on X that “the latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible for this incident.” The attack is thought to be the largest crypto hack to date, surpassing the $1.5bn Bybit hack in 2025, which was blamed on the TraderTraitor unit, also known as Lazarus Group. Binance said it would increase investment in AI tools to detect security threats, engage third-party cyber experts for a full review, seek to establish a security research fund, and work with leading AI and security firms on targeted initiatives. The company had not previously responded to BBC queries about North Korea’s alleged involvement.