The world's largest cryptocurrency exchange, Binance, has published a preliminary report on a massive cyberattack in which perpetrators gained control of the company's internal crypto wallets and withdrew funds totaling $6.3 billion. According to the exchange's own estimate, this could become the largest financial theft in history. A key link in the attack was a fake job interview through which hackers penetrated the workspace of one of the engineers, as well as a compromised internal AI-based tool.
Attack Mechanics: From Fake Interview to Wallet Access
According to the report, the operation was built on a combination of social engineering and technical penetration. A software engineer on the crypto wallet development team, who was looking for a job, mistook it for a genuine job interview and even held a virtual meeting with the "CEO" of a nonexistent company. During this process, he downloaded a repository containing malicious code to his computer. Simultaneously, earlier in June, another employee of the same team had installed a compromised AI tool, giving the attackers partial access to the internal infrastructure and information about team members' job duties.
Timeline: How the Operation Unfolded from June to October
According to Binance, the attack unfolded in stages. In June, the first AI tool was compromised; the exchange discovered the incident, replaced the device, and changed credentials, but information about employee roles had already leaked. In September, malicious code was installed on the second developer's computer via a fake interview. On October 20, the attackers used the compromised computer and the internal AI tool to access both developers' systems. The culmination occurred on October 29: hackers used credentials previously stolen from the first employee on the second machine and ran a malicious script that directly initiated the withdrawal of $6.3 billion.
Binance's Response and Customer Compensation
In response to the incident, the company announced increased investments in AI-based threat detection systems, as well as work on establishing a security research fund and launching joint initiatives with leading AI companies. Binance promised to reimburse losses for all clients whose funds were stolen as a result of the attack. In the report, the company apologized to users, partners, and the industry for the operational disruptions and uncertainty, emphasizing that "this should not have happened."
Attribution: FBI Accusations and North Korea's Stance
Earlier, the US Federal Bureau of Investigation blamed a North Korean hacking group for the attack, but North Korea rejected these accusations. Thus, the question of the exact perpetrator of the operation remains a subject of conflicting statements from agencies, while the fact of the attack and the amount of stolen funds are confirmed by Binance itself in its preliminary report.
