Binance has disclosed that the record $6.3 billion theft from its platform was executed through a sophisticated, multi-stage operation involving fake job interviews and a compromised internal artificial intelligence tool. According to initial findings published by the world’s largest cryptocurrency exchange, attackers engineered a complex social engineering campaign to infiltrate the company’s infrastructure.
The breach began when hackers targeted a Binance engineer via a legitimate recruitment platform, luring them into a series of fraudulent interviews with impostors posing as company representatives. To establish credibility, the perpetrators shared fabricated social media profiles containing personal images. During a second interview, the engineer was tricked into downloading malware disguised as a technical assignment. The malicious code employed obfuscation techniques to evade detection, granting the attackers a foothold on the engineer’s device.
Leveraging this compromised machine alongside a breached internal AI tool in October, the intruders subsequently seized control of two additional engineers’ laptops. This lateral movement allowed them to manipulate critical wallet management tools and drain billions of dollars in digital assets. Binance characterized the event as a “serious and highly sophisticated security incident,” issuing a formal apology and acknowledging that the failure “should not have happened.”
The incident forced a global suspension of withdrawals, a restriction lifted only after services were restored on Sunday. Following the reopening, customers withdrew billions of dollars in assets. In response, Binance confirmed it has engaged law enforcement to trace and freeze the stolen funds and has allocated reserves exceeding 100% of the lost value to cover the shortfall. As of Saturday, the exchange reported that 98% of the affected token assets had been replenished. The attack is currently regarded as the largest cryptocurrency hack in history.
