Binance says fake job interview and poisoned AI tool let hackers steal $6.3bn
Binance has traced the $6.3bn theft from its systems to a fake job interview and a tampered AI tool, the exchange said on Tuesday in its account of an attack the FBI and private analysts attribute to North Korean state-backed hackers.
The exchange said the intrusion began in June, when a developer on its wallet team downloaded an AI tool. Binance detected it and changed passwords, but the hackers had already uncovered the identity of that employee and several colleagues. In September a second software developer, looking for a new job, downloaded "malicious code databases" onto his computer while conducting a virtual interview with the chief executive of a fictitious company.
On 20 October, according to the investigation, the hackers used that computer and an AI tool to take control of the IT systems of the wallet developer and a colleague. Nine days later they used the colleague's computer and the first developer's stolen passwords to plant a malicious script that carried out the attack. "This should not have happened, and we apologise for the concern, disruption and uncertainty this has caused our users, partners and the entire industry," Binance said.
Investors left in droves after the cyber attack. Binance said customers initially withdrew $4.6bn, but about $1bn has since flowed back. Experts say institutional investors could become more hesitant in the crypto market, slowing the hoped-for inflow of capital.
What it means for Pakistan: The theft is a reminder for Pakistani users of offshore exchanges that the wallet keys and login credentials they hold are only as safe as the platforms they trust, and that a single compromised developer can put customer funds at risk. It also bears on the work of the Pakistan Virtual Assets Regulatory Authority as it builds a licensing regime for virtual asset service providers: cyber security, incident reporting and custody safeguards are likely to be central conditions, and the case shows why. For Pakistanis who use crypto to receive remittances or hold savings, the episode underlines the case for regulated local custody rather than reliance on a single foreign platform.
