Binance Reveals How Hackers Executed $6.3 Billion Crypto Theft Using Fake Interviews and AI Tool

Image: Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist · Source

Binance detailed a sophisticated months-long hack involving fake hiring processes and malware, with attackers exploiting the exchange’s internal AI to steal $6.3 billion in cryptocurrency.

Binance, the world’s largest cryptocurrency exchange, has published an extensive postmortem revealing the tactics behind the largest crypto theft to date, totaling approximately $6.3 billion. According to the report posted by Binance and coverage by The Verge, the hack unfolded over several months by combining phishing, malware, and exploitation of internal tools.

The attack chain began in June when a Binance developer unknowingly downloaded a tampered installer distributed through a malicious Google advertisement. This installer introduced malware that exposed sensitive details about Binance engineers and their workflows. Binance’s security team detected this initial malware, replacing the compromised device.

Months later in September, another engineer was targeted through a sophisticated social engineering ploy posing as a recruiter. The attacker established trust with multiple interviews and presented a fake assignment that actually contained malware. This malware replaced a legitimate Python development tool (pyenv) with a malicious version, granting backdoor access undetected by endpoint security software due to evasive techniques and obfuscation.

By October, the FBI linked the group behind the attack to a North Korean cyber unit known as "TraderTraitor." Using Binance’s own internal AI tool, the attackers took control of wallets belonging to the first compromised engineer and a third employee. On October 29, they accessed a third employee’s computer to launch the heist.

The report explains why Binance’s multi-party computation (MPC) hot wallet architecture delayed blocking unauthorized transfers. Since no single private key existed to revoke malicious authorizations instantly, nearly two hours elapsed during which substantial value was stolen.

Binance states it has since frozen or intercepted about $2.85 billion in stolen assets and replenished 98% of impacted tokens, with user withdrawals broadly resumed. CEO Richard Teng emphasized that no Binance user suffered losses.

While the company highlights the attack’s complexity, details about the internal AI tool exploited remain scarce, and why it was vulnerable is not fully explained. The incident also serves as a caution about job interview scams that involve downloading code or software linked to employer systems.

This case underscores evolving threats in crypto security, where technical breaches combine with social engineering and insider access to achieve large-scale thefts, even from top-tier exchanges like Binance.