Binance has revealed that hackers stole $6.3bn worth of cryptocurrency from its systems after using fake job interviews, malicious software and an internal artificial intelligence (AI) tool to compromise the computers of its engineers in what is believed to be the largest cryptocurrency theft on record.
The world’s largest cryptocurrency exchange said the attackers carried out a sophisticated, multi-stage operation that enabled them to infiltrate its systems and gain access to digital wallets holding billions of dollars in assets. The breach exposed the risks associated with cybercriminals exploiting employees and trusted workplace tools to bypass security measures.
According to Brandspur Banking News Desk, Binance’s initial findings indicate that the attack began with social engineering, a technique in which criminals manipulate individuals into revealing sensitive information or granting access to protected systems. One of the exchange’s engineers was approached through a legitimate job-hunting platform and invited to participate in fake interviews with individuals posing as company representatives.
The hackers reportedly went beyond conventional phishing tactics to establish credibility, sharing social media profiles containing personal photographs to make their identities appear genuine. During a subsequent interview, the engineer was instructed to download a software assignment that was actually malicious code designed to infiltrate his computer.
See Also: Binance Suffers $6bn Crypto Heist As Investigators Suspect North Korean Hackers
Binance said the malware employed obfuscation techniques to avoid detection, allowing the attackers to compromise the engineer’s device. The hackers subsequently exploited the compromised computer and an internal AI tool to gain access to the laptops of two other engineers, expanding their reach within the company’s systems.
The breach had significant consequences for customers, with Binance suspending cryptocurrency withdrawals globally as it responded to the incident. The restriction prevented users from moving their digital assets off the platform until services were restored on Sunday.
Following the reopening of withdrawals, customers moved billions of dollars’ worth of cryptocurrency out of the exchange, highlighting the uncertainty that can follow a major security breach involving a platform used by millions of traders.
Binance apologised for the disruption and said it had taken steps to address the incident, including working with law enforcement agencies to trace and freeze affected assets. The company also said it had reserved more than 100 per cent of the funds required to cover the losses, while 98 per cent of the affected token assets had been replenished as of Saturday.
The scale of the attack has drawn renewed attention to the security of cryptocurrency exchanges, where a successful breach can expose large amounts of digital assets and trigger widespread withdrawals by customers.
US agencies, including the Federal Bureau of Investigation (FBI) and the Secret Service, have been assisting Binance with efforts to trace the stolen cryptocurrency. The FBI has attributed the attack to North Korea, a claim Pyongyang has rejected.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior official in the country, described the accusations as an attempt by the United States to damage North Korea’s reputation. The country has repeatedly denied responsibility for major cyberattacks attributed to it.
The suspected involvement of North Korean hackers has also revived concerns about the activities of the TraderTraitor unit, also known as the Lazarus Group, which was blamed for the $1.5bn theft from cryptocurrency exchange Bybit in 2025.
Binance said it would increase investment in AI-powered security tools capable of identifying emerging threats and bring in external cybersecurity experts to conduct a comprehensive review of the breach.
The exchange also plans to establish a security research fund and collaborate with leading AI and cybersecurity firms on targeted initiatives aimed at strengthening its defences.
For cryptocurrency users, the incident underscores how digital assets can be exposed not only through weaknesses in blockchain technology but also through compromised employees, deceptive recruitment processes and malicious software disguised as legitimate work assignments.
