--- title: "Fake Interview and Compromised AI Tool: How Hackers Stole $6.3B from Binance" description: "Binance disclosed details of an attack where hackers stole $6.3 billion via a fake interview and a compromised AI tool. The exchange promises to compensate clients for losses." date: 2026-11-04T02:13:55.450Z lang: en url: https://xab.info/en/posts/binance-fake-interview-hack-6-3-billion tags: [binance, cyberattack, crypto-theft, ai-security, hacking] author: "Alexander Buran" publisher: "XAB.info" --- # Fake Interview and Compromised AI Tool: How Hackers Stole $6.3B from Binance ![Black and yellow security combination lock against the background of a technological digital staircase](https://xab.info/media/2026/11/04/binance-fake-interview-hack-6-3-billion/binance-fake-interview-hack-6-3-billion-1.webp) ## Key Points - Hackers penetrated Binance through a fake interview and a compromised internal AI tool, stealing $6.3 billion. - The attack unfolded from June to October: first the AI tool was infected, then the second developer's computer via a fake interview. - On October 29, the perpetrators ran a malicious script initiating the withdrawal of funds from the exchange's crypto wallets. - Binance promises to compensate clients and is boosting investments in AI threat detection; the FBI blames a North Korean group, which North Korea denies. The world's largest cryptocurrency exchange, Binance, has published a preliminary report on a massive cyberattack in which perpetrators gained control of the company's internal crypto wallets and withdrew funds totaling $6.3 billion. According to the exchange's own estimate, this could become the largest financial theft in history. A key link in the attack was a fake job interview through which hackers penetrated the workspace of one of the engineers, as well as a compromised internal AI-based tool. ### Attack Mechanics: From Fake Interview to Wallet Access According to the report, the operation was built on a combination of social engineering and technical penetration. A software engineer on the crypto wallet development team, who was looking for a job, mistook it for a genuine job interview and even held a virtual meeting with the "CEO" of a nonexistent company. During this process, he downloaded a repository containing malicious code to his computer. Simultaneously, earlier in June, another employee of the same team had installed a compromised AI tool, giving the attackers partial access to the internal infrastructure and information about team members' job duties. ### Timeline: How the Operation Unfolded from June to October According to Binance, the attack unfolded in stages. In June, the first AI tool was compromised; the exchange discovered the incident, replaced the device, and changed credentials, but information about employee roles had already leaked. In September, malicious code was installed on the second developer's computer via a fake interview. On October 20, the attackers used the compromised computer and the internal AI tool to access both developers' systems. The culmination occurred on October 29: hackers used credentials previously stolen from the first employee on the second machine and ran a malicious script that directly initiated the withdrawal of $6.3 billion. ### Binance's Response and Customer Compensation In response to the incident, the company announced increased investments in AI-based threat detection systems, as well as work on establishing a security research fund and launching joint initiatives with leading AI companies. Binance promised to reimburse losses for all clients whose funds were stolen as a result of the attack. In the report, the company apologized to users, partners, and the industry for the operational disruptions and uncertainty, emphasizing that "this should not have happened." ### Attribution: FBI Accusations and North Korea's Stance Earlier, the US Federal Bureau of Investigation blamed a North Korean hacking group for the attack, but North Korea rejected these accusations. Thus, the question of the exact perpetrator of the operation remains a subject of conflicting statements from agencies, while the fact of the attack and the amount of stolen funds are confirmed by Binance itself in its preliminary report. ## Accounts differ ### Involvement of the North Korean hacking group in the attack - **FBI (USA):** Blames the North Korean hacking group for the attack ([3dnews.ru](https://3dnews.ru/1150807/falshivoe-sobesedovanie-stoilo-binance-v-63-mlrd-hakeri-vzlomali-birgu-cherez-razrabotchika)) - **North Korea:** Rejects accusations of involvement in the attack ([3dnews.ru](https://3dnews.ru/1150807/falshivoe-sobesedovanie-stoilo-binance-v-63-mlrd-hakeri-vzlomali-birgu-cherez-razrabotchika)) ## Fact-Check & Sources - [Фальшивое собеседование стоило Binance $6,3 млрд: хакеры взломали биржу через разработчика window-new](https://3dnews.ru/1150807/falshivoe-sobesedovanie-stoilo-binance-v-63-mlrd-hakeri-vzlomali-birgu-cherez-razrabotchika) - The primary source contains the text of Binance's preliminary report: the attack timeline (June, September, October 20 and 29), the $6.3 billion figure, the promise of compensation and the company's quote, as well as information about FBI accusations against a North Korean group and North Korea's rejection of them. The data consists of statements from the exchange and agencies; there is no independent confirmation of the amount in the source. ## FAQ ### How much funds were stolen from Binance as a result of the attack? According to Binance's preliminary report, hackers withdrew $6.3 billion, which, by the exchange's estimate, could become the largest financial theft in history. ### How exactly did hackers penetrate the exchange's systems? They used a fake job interview through which one of the engineers downloaded malicious code, as well as a previously compromised internal AI tool. On October 29, using stolen credentials, a script was run initiating the fund withdrawal. ### Will Binance compensate customer losses? Yes, the company promised to reimburse losses for all clients whose funds were stolen in the attack and announced expanded investments in AI-based threat detection systems. ### Who, according to the FBI, is behind the attack? The FBI blamed a North Korean hacking group, but North Korea rejected these accusations.