Social engineering and artificial intelligence were used together in the $6.3 billion cyber attack on Binance

In the first part of Anadolu Agency's (AA) two-part dossier news titled "The Biggest Robbery of the Digital Age", the biggest thefts in the history of crypto money, the months-long preparation process of the Binance attack and the methods used in the attack were discussed.

In the cyber attacks against Binance, attackers not only social engineered through fake job interviews but also used a combination of malware, in-house artificial intelligence tools, and advanced transaction authorization methods.

The $6.3 billion cyber attack, which was carried out by infiltrating computer systems without using weapons or traditional theft methods, was recorded as the largest cryptocurrency theft of the digital age.

In the cryptocurrency industry, approximately $1.5 billion worth of digital assets were previously stolen from Bybit in February 2025, approximately $600 million worth of digital assets were stolen from video game Axie Infinity's blockchain network Ronin Network in March 2022, and approximately $600 million worth of digital assets were stolen from decentralized finance platform Poly Network in August 2021.

The amount stolen in the cyber attack on Binance reached approximately 4.2 times the amount in the "Bybit Hack Incident", which was previously recorded as the largest theft in the history of cryptocurrency.

Attackers social engineered through fake job interviews

According to Binance's report on the attack published on November 3, the attackers first targeted the computer of the engineer who was trying to install an artificial intelligence-supported coding tool in June.

The company's security team detected suspicious activity and renewed the engineer's device and access information. However, in this process, the attackers managed to collect information about the employee's role and other engineers he worked with.

In September, people posing as representatives of a non-existent company invited another engineer working at Binance to a fake job interview.

After the meeting, the engineer downloaded files containing malicious code to his work computer as part of the software development task given by fake representatives, unknowingly allowing attackers to gain access to company systems.

The attackers, who accessed the employee's computer in this way, also took advantage of the company's in-house artificial intelligence tool and reached the computers of 2 more engineers on October 20.

233.46 million XRP was stolen in the first four minutes with the seized authorizations

On October 29, attackers placed malware on an engineer's computer, using the access information they obtained from another engineer, into the company's system.

Unauthorized access was then gained to an internal wallet signing service that verifies transactions from digital wallets.

Thus, using the access rights they obtained, the attackers transferred 233.46 million XRP from five digital wallets belonging to Binance to the address under their control in just 4 minutes. Later, approximately 970 thousand 500 SOL, approximately 44.2 million OP and 18 thousand 270 BTC were transferred.

Although the company detected unusual transfers and stopped withdrawals, not all unauthorized transactions could be blocked immediately due to some prior authorizations obtained by the attackers.

In its statement regarding the incident on October 30, Binance announced that the total impact of the incident was calculated as approximately 6.3 billion dollars and that approximately 3 billion dollars of assets were frozen on the blockchain as a result of the work carried out with industry partners.

On the other hand, the US Federal Bureau of Investigation (FBI) accused North Korea of ​​stealing $6.3 billion worth of digital assets from Binance on October 31, while North Korea denied these allegations.

Preparations for the Binance heist took months

Ari Redbord, Head of Global Policy and Government Relations at US-based blockchain analysis company TRM Labs, evaluated the cyber attack against Binance to an AA reporter.

"Targeting wallet engineers by name, determining who authorized signatories are, and understanding how the team works together requires months of research. Job titles, professional profiles, and conferences attended provide the necessary information to identify the target," Redbord said. he said.

Stating that external codes should be run in a disposable virtual environment on separate hardware, not on the work computer, Redbord also emphasized that the in-house artificial intelligence tool provides attackers with the opportunity to move between systems.

Redbord reminded that Binance suspended withdrawals by detecting unusual transfers, but that some assets had already been transferred to other addresses, and that cryptocurrency transfers were completed within minutes and could not be reversed.

Additionally, Redbord underlined that exchanges should implement hot wallet limits, withdrawal limits and delay mechanisms for large transfers to protect against attacks.

Even experienced engineers can be exposed to social engineering

Associate Professor, Department of Information Systems, University of Colorado Denver, USA. Dr. Ersin Dinçeli: "The Binance incident is not a sudden and isolated attack, but a carefully planned, multi-stage operation that lasted several months." he said.

Referring to the use of fake job interviews and recruitment processes in cyber attacks, Dinçeli said:

"We often say that people are the weakest link in information security. In fact, industry reports reveal that the human factor plays a role in the majority of security breaches. Even the most advanced technical security measures can be rendered ineffective when employees are unaware of social engineering tactics or how attackers exploit human vulnerabilities such as greed, curiosity, altruism, fear and a sense of urgency. What makes social engineering particularly challenging is that even experienced engineers can fall victim to these attacks. The Binance case clearly demonstrated this risk."

Dinçelli stated that the first stage of cyber attacks is reconnaissance and emphasized that at this stage, attackers collect intelligence about their targets and create comprehensive profiles.

Stating that with the spread of open source intelligence (OSINT) tools and artificial intelligence-supported automation, these activities can be carried out at very low or no cost, Dinçelli explained that social engineering techniques and artificial intelligence systems were used together in the Binance case.