Binance says hackers stole a record $6.3bn in cryptocurrency through a multi-stage attack that began with social engineering targeting one of its engineers. The company said the incident involved fake job interviews, malicious software and a compromised internal AI tool.
According to Binance’s initial findings, the engineer was contacted through a legitimate job-hunting platform and invited to interviews with people posing as company representatives. The attackers used social media accounts containing personal images to build trust, the exchange said.
During a second interview, the engineer was asked to download malware disguised as an assignment. Binance said the malicious code used obfuscation techniques to evade detection. The attackers then used the compromised computer and an internal AI tool to gain control of two other engineers’ laptops and carry out further steps in the breach.
Binance described the incident as a “serious and highly sophisticated security incident” and apologised to users and partners. It suspended customer withdrawals globally while responding to the attack; withdrawals resumed on Sunday, after which customers withdrew billions of dollars’ worth of assets.
The company said it had set aside more than 100% of the funds needed to cover the loss and that 98% of the affected token assets had been replenished as of Saturday. It also said it was working with law enforcement to trace and freeze affected assets.
The FBI and US Secret Service have assisted Binance in tracing the stolen cryptocurrency. Binance said the latest information from the FBI indicated that North Korea was responsible. Pyongyang denied involvement, with Kim Yo Jong calling the accusations an attempt to damage the country’s image.
Binance said it plans to increase investment in AI tools for detecting security threats, bring in third-party cyber experts for a full review and establish a security research fund. It also said it would work with AI and security firms on targeted initiatives.
Sources: BBC News World.