Binance: Hackers gained access through a fake interview

After the billion-dollar robbery at the world's largest crypto exchange Binance, the company has announced new findings. Accordingly, the attack, in which hackers withdrew $6.3 billion in cryptocurrencies from IT systems last week, began in June. Access was obtained, among other things, via a compromised AI tool and a fake job interview - a "sophisticated, multi-stage campaign".

An employee from the development team for the digital wallet downloaded manipulated software in June, Binance said. A problem was identified and the employee's passwords were changed. However, the hackers revealed his identity and that of several colleagues. In September, a second software developer loaded another piece of malware onto his computer while he was looking for a new job and had a virtual conversation with the boss of a fictitious company.

The hackers later took control of the IT system of the wallet developer and one of his colleagues via his computer and an AI tool. Using his computer and stolen passwords, they planted a malicious script that carried out the attack. “This shouldn’t have happened,” explained Binance and apologized for the uncertainty among “users, partners and the entire industry.”

The FBI and private analysis firms had blamed state-controlled hackers from North Korea for the attack. The country's leadership denies the allegations. According to Binance, the security team has already detected 57 cases of possible cyber threats linked to North Korea in 2026.

Investors had recently turned away from the crypto exchange. According to the company, they withdrew $4.6 billion, but around $1 billion has since been returned.