Binance has revealed that hackers behind a $6.3 billion (£4.7 billion) theft used fake job interviews and a compromised internal artificial intelligence (AI) tool to carry out the attack.
Initial findings published by the company, which operates the world’s largest cryptocurrency exchange, said the hackers gained access to its systems through a “sophisticated, multi-stage campaign”.
According to Binance, the attackers used several techniques, including malicious software downloads, to compromise the computers of its engineers and gain control of tools used to drain billions of dollars’ worth of cryptocurrency from its wallets.
The exchange described the incident as a “serious and highly sophisticated security incident” and apologised, saying “this should not have happened”.
In a post on X, Binance said the hackers targeted its engineers through social engineering techniques. These involve manipulating people into disclosing sensitive information or taking actions that give attackers access to their accounts and systems.
One of the engineers was contacted through a legitimate job-hunting platform and invited to bogus interviews with people posing as company representatives.
Binance said the attackers used more advanced and deceptive methods to build trust with the engineer, including sharing social media accounts containing personal images.
During a second interview, the engineer was instructed to download malware disguised as an assignment. The software deployed malicious code using obfuscation techniques designed to evade detection.
The attackers then used the compromised computer and an internal AI tool to gain control of two other engineers’ laptops in October, allowing them to carry out the next stages of the attack.
The incident forced Binance to suspend withdrawals for customers globally, preventing users from moving their cryptocurrency off the platform until services were restored on Sunday.
Customers withdrew billions of dollars’ worth of assets after withdrawals resumed.
“We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company said.
Binance added that it had taken several steps in response to the incident, including working with law enforcement agencies to trace and freeze affected assets.
The company also said it had set aside more than 100% of the funds required to cover the losses. As of Saturday, 98% of the affected token assets had been replenished.
The $6.3 billion incident is believed to be the largest cryptocurrency hack to date.
