PARIS/SEOUL: Binance said on Tuesday hackers used a bogus job interview to compromise a computer and an internal artificial intelligence tool to gain control over the company’s wallets before draining $6.3 billion worth of crypto, in what could be the largest-ever financial heist.
In initial report into what went wrong, the world’s largest crypto exchange detailed a sophisticated hacking endeavour that began with an advert for a tampered version of a coding tool in June and set in chain a series of security breaches that culminated in the theft of the crypto on Oct 29. The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers who have lost funds through the hack.
Binance said that the attack started when an employee from its wallet developer team in June downloaded an AI tool that had been tampered with. The crypto exchange detected this, replaced the device and changed credentials but the employee’s role and that of others on the wallet team were exposed to the hacker.
Then in September a second software engineer seeking a new job downloaded “malicious code repository” onto his computer after interviewing for what the person thought was a legitimate role, including meeting virtually with the CEO of a fictitious company.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, slams FBI for blaming her country over the hack
On Oct 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer’s system and that of a second wallet developer on that team. On Oct 29, the attacker used the second wallet developer’s computer, using stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the report. Binance said that as a result of the hack, it was increasing investment in AI-enabled detection and is working on establishing a security research fund and targeted initiatives with leading AI companies.
FBI allegations rejected
Pyongyang blasted on Monday the FBI’s allegations it was behind the theft of $6 billion from cryptocurrency platform Binance, as it test-fired strategic cruise missiles in a new display of its weapons capabilities.
The missile launch came on the heels of a public rebuttal from Kim Yo Jong, the powerful sister of leader Kim Jong Un, who slammed the FBI’s allegations as a “grave political provocation”. On Saturday, the FBI said a North Korea-affiliated hacking group called TraderTraitor had been behind the hack.
Experts see the incident as potentially the largest cryptocurrency theft in history, with a haul equalling “nearly a quarter of the DPRK’s estimated annual GDP,” Michael Bosack, founding director of the Parley Policy Institute and a former UN Command official, said.
Kim Yo Jong said the FBI’s claim was “absurd rhetoric and nothing new,” given prior US allegations that Pyongyang was behind last year’s major hack of Bybit.
Published in Dawn, November 4th, 2026
