Binance disclosed that hackers stole a record $6.3bn (£4.7bn) from the exchange using fake job interviews and a compromised internal AI tool.
Binance said the breach involved a sophisticated, multi-stage campaign that compromised engineers’ computers through malicious software downloads.
The firm described the incident as a “serious and highly sophisticated security incident” and apologised, saying “this should not have happened”.
Binance explained that hackers used social engineering, including phishing, to target engineers and that one engineer was approached via a legitimate job-hunting platform and invited to bogus interviews with fake company representatives.
The perpetrators built trust by sharing social-media accounts containing personal images and then instructed the engineer to download malware disguised as an “assignment” during a second interview. The code employed “obfuscation techniques” to evade detection.
Using the compromised computer and an internal AI tool, the attackers gained control of two other engineers’ laptops and proceeded to drain Binance’s wallet of billions of dollars in crypto.
The breach forced Binance to suspend withdrawals worldwide until the service was restored on Sunday, after which customers withdrew billions of dollars worth of assets.
Binance said it had worked with law enforcement to trace and freeze the assets and set aside more than 100 per cent of the funds needed to cover the loss. It added that 98 per cent of the token assets impacted had been “replenished” as of Saturday.
US agencies including the FBI and the Secret Service are assisting Binance, and analysts said the hack bore the hallmarks of North Korean involvement.
North Korea denied the allegation; Kim Yo Jong called the accusations a “sinister attempt” by the US to damage the country’s image.
The Lazarus Group, also known as the TraderTraitor unit, was previously blamed for a $1.5bn hack of Bybit in 2025.
Binance posted on X that the latest information released by the FBI indicates that the Democratic People’s Republic of Korea is responsible for the incident.
Binance said it will increase investment in AI tools to detect security threats, engage third-party cyber experts for a full-scale review, seek to establish a security research fund and work with leading AI and security firms on targeted initiatives.
