Cryptocurrency exchange Binance has revealed that hackers used elaborate social engineering tactics, including fake job interviews and compromised internal AI tools, to orchestrate the record-breaking $6.34 billion cyber attack.
The security breach, which took place on October 29, allowed malicious actors to infiltrate the Hot wallet infrastructure and drain billions in digital assets across multiple blockchains. According to initial investigative reports released by Binance, the multi-stage campaign began months earlier.
In June, an engineer accidentally downloaded a rigged installer, and by September, hackers posing as recruiters hired another engineer through a legitimate job-hunting platform.
During these fake video interviews, the perpetrators built trust before instructing the employee to download Encoding task with hidden malware designed to evade endpoint security detection. With this compromised machine, the attackers used internal AI tools to gain access to wallet deployment permissions and execute the breach.
Binance Co-CEO Richard Teng detailed the sophisticated progress during an interview on CNBC’s “Squawk on the Street”, rejecting theories of a simple single point of failure:
“In June, [the attackers] put up a fake version of a developer tool and trick one of our engineers into installing it,” Teng said.
“In September, they posed as recruiters and conducted a series of job interviews with another engineer, which culminated in a coding exercise containing hidden malware designed to circumvent security…[ed] Access to that breach[ed] the system that authorized our wallet transaction.
Although federal intelligence agencies, including the FBI, have linked the cyber attack to North Korean state-sponsored groups such as TraderTraitor, Binance has focused heavily on immediate seizure, asset recovery and structural remediation.
The platform temporarily suspended withdrawals while working together with industry partners, such as Tether, Circle, and Ripple, to freeze approximately $3 billion in stolen funds.
Teng confirmed that Binance has set aside funds to cover all losses, successfully recovering 98% of the affected token assets while entering the remaining illiquid holdings. Internal networks, wallet systems and AI tools have since been completely rebuilt, credentials rotated and employee devices subjected to enhanced security checks.
“We are also getting an independent expert to review everything we have done, and we will continue to strengthen our defense as the investigation continues,” Teng added. “We are working around the clock with law enforcement and with industry partners to track down and freeze the stolen funds on this front.”