Hackers stole a record $6.3bn from Binance using fake job interviews and a compromised internal AI tool, the company revealed. The perpetrators contacted one of Binance's engineers through a job-hunting platform and invited him to bogus interviews with fake company representatives. During a second interview, the engineer was instructed to download malware disguised as an "assignment." The hackers then used the engineer's compromised computer and a compromised internal AI tool to gain control of two other engineers' laptops and execute the theft.
Binance called it a "serious and highly sophisticated security incident" and apologized, saying the attack "should not have happened." The company suspended global withdrawals, disrupting customers until service resumed on Sunday. Binance set aside more than 100% of the funds needed to cover the loss, with 98% of affected token assets replenished as of Saturday.
The FBI and Secret Service assisted Binance in tracing the stolen cryptocurrency. US crime agencies and cyber analysts said the hack bore signs of being orchestrated by North Korea. Binance confirmed on Tuesday that "the latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident." North Korea denied involvement through a statement by Kim Yo Jong, a top official and sister of leader Kim Jong Un, calling the accusations a "sinister attempt" by the US to damage the country's public image.
Binance said it would increase investment in AI tools to detect security threats, engage third-party cyber experts to review the incident, establish a security research fund, and work with leading AI and security firms on targeted initiatives.