Hackers orchestrated a sophisticated attack on Binance using deceptive job interview tactics and a compromised internal artificial intelligence tool to steal a record $6.3bn (£4.7bn) in cryptocurrency, the exchange has disclosed. According to BBC News, the breach represents the largest cryptocurrency theft in history and prompted the company to suspend withdrawals globally until operations resumed on Sunday.
Binance characterised the incident as a "serious and highly sophisticated security incident" and issued an apology to users and the wider industry. The company stated:
"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry."The exchange revealed it had set aside more than 100% of the funds needed to cover losses, with 98% of affected token assets replenished by Saturday.
Following the attack, TechCrunch reported that Binance had covered approximately 95% of the stolen assets, with the remaining funds taking longer to source. The company assured users they would not bear the losses from the theft. When withdrawals resumed, the platform processed $4.649bn in withdrawals and $1.01bn in deposits over nine and a half hours, resulting in a net outflow of approximately $3.64bn according to Investor Daily.
How did hackers compromise Binance's systems?
The attackers employed a multi-stage campaign that began by targeting Binance engineers through social engineering techniques. One engineer was contacted via a legitimate job-hunting platform and invited to participate in bogus job interviews with fake company representatives. The perpetrators employed increasingly deceptive methods to establish credibility, including sharing social media accounts containing personal images to build trust.
During a second interview, the engineer was instructed to download what appeared to be an assignment file. This file actually contained malware equipped with obfuscation techniques designed to evade detection systems. The compromised engineer's computer then became a foothold for the attackers to access two other engineers' laptops and deploy the next phase of the assault.
According to reporting from Bitcoin News, an earlier compromise in June involved a wallet engineer downloading a tampered version of the Homebrew software installer while attempting to install an artificial intelligence coding tool. The stolen assets included substantial quantities of major cryptocurrencies: 18,270 BTC, 233.46 million XRP, approximately 970,500 SOL, and 44.2 million OP, among others.
Binance disclosed that hackers leveraged both the compromised engineer's computer and a compromised internal artificial intelligence tool in October to gain control over additional systems and execute the subsequent stages of the attack. The company worked with law enforcement to trace and freeze affected assets following the incident.
Who is suspected of carrying out the attack?
The Federal Bureau of Investigation, US Secret Service, and cyber analysts have attributed the hack to North Korea-linked actors. The group responsible, known as TraderTraitor or the Lazarus Group, was previously blamed for a then-record $1.5bn theft from cryptocurrency exchange Bybit in 2025.
North Korea has categorically denied involvement in the attack. Kim Yo Jong, a senior official in the Democratic People's Republic of Korea and sister of leader Kim Jong Un, characterised the accusations as another "sinister attempt" by the United States to damage North Korea's international reputation. The country has consistently rejected blame for numerous major cyber attacks attributed to it in recent years.
Binance initially did not respond to inquiries about North Korea's alleged involvement but later acknowledged the findings. The company stated in a post on its social media platform:
"The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."
What security measures is Binance implementing?
In response to the breach, Binance announced a comprehensive security overhaul. The exchange plans to increase investment in artificial intelligence tools capable of detecting security threats and will engage third-party cyber experts to conduct a full-scale review of the incident. The company also committed to establishing a security research fund and collaborating with leading artificial intelligence and security firms on targeted initiatives.
Binance's US-facing exchange was reported to have remained unaffected by the attack, though US authorities continued working to trace, freeze, and recover the stolen funds. The company stated it was still working to source the remaining affected assets, though no scheduled completion date has been provided for this recovery process.
What happens next for Binance and its customers?
Binance continues efforts to recover the remaining stolen cryptocurrency, with the company committed to ensuring users do not bear the financial burden of the theft. The exchange is working alongside law enforcement agencies to trace and recover additional assets. Customers can resume normal withdrawal and deposit operations, though the incident has prompted heightened scrutiny from global regulators regarding cryptocurrency exchange security standards and customer asset protection.
