Binance reveals bogus hiring process led to record $6.3bn cryptocurrency theft

Binance has revealed that cybercriminals behind a record $6.3bn cryptocurrency theft breached its networks by posing as recruiters conducting fake job interviews and hijacking an internal artificial intelligence tool.

The cryptocurrency trading platform, recognized as the largest in the world, shared preliminary findings describing the breach as an elaborate and multi-tiered attack. According to the company, attackers deceived an engineer through social engineering tactics before using malicious files to take control of personnel hardware and ultimately empty digital wallets holding billions in crypto assets.

The breach began when perpetrators reached out to a Binance technical employee via a genuine employment recruitment platform. Attackers staged mock job evaluations featuring fabricated business representatives. To establish credibility, the impostors presented social media profiles displaying personal photographs.

During a follow-up interview session, the worker was prompted to download what was presented as an evaluation test. In reality, the file contained evasive malicious software that bypassed system detection. The intruders then used the compromised machine alongside an internal artificial intelligence system in October to infiltrate computers belonging to two additional engineering staff members, enabling the wider assault.

In the immediate aftermath, Binance froze withdrawal requests worldwide. The exchange has since resumed operations, prompting billions of dollars in client redemptions following the restoration of service on Sunday. Binance issued an apology for the disruption, acknowledging the event should never have occurred.

The firm stated that it has reserved funds exceeding the full value of the lost assets, adding that 98 percent of the affected digital tokens were replenished by Saturday. Company representatives are collaborating with investigators to locate and immobilize the missing holdings.

American authorities, including the Federal Bureau of Investigation and the Secret Service, have stepped in to assist the tracking effort. Investigators and industry specialists have pointed toward North Korean involvement. Binance noted in a social media statement that updated FBI findings directly linked North Korea to the intrusion.

Officials in Pyongyang rejected the claims. Kim Yo Jong, a high-ranking official and the sister of North Korean leader Kim Jong Un, characterized the allegations as an effort by American authorities to harm the state's global reputation.

Moving forward, Binance plans to commission an independent audit by outside cybersecurity specialists, boost spending on defensive artificial intelligence systems, and set up a dedicated security research endowment.