Binance says fake job interviews helped hackers steal $6.3bn
Binance has blamed a months-long social engineering campaign for the $6.3bn theft that hit the exchange, saying hackers posed as recruiters and company executives to plant malicious code on an engineer's machine. In its most detailed account of the attack, published on Tuesday, the exchange said the operation involved a "sophisticated multi-stage campaign" and was attributed to North Korea.
The report described how one of Binance's engineers was approached on a job-search platform by someone posing as a project director, then interviewed over a messaging app by a person claiming to be the chief executive of a fictitious company. The engineer was asked to download a task that contained a "malicious code repository", which triggered a series of unauthorised activities, according to the report. Richard Teng, co-chief executive of Binance, said: "This was not a single mistake or a single breach. It was a campaign developed over many months," adding that the attackers combined fake hiring interviews, malware disguised as legitimate developer tools, compromised devices and AI techniques.
Binance first reported the attack on 29 October and initially said the attackers may have compromised a software engineer's laptop, allowing the thieves to withdraw cryptocurrencies from the platform. In a later post, it said the attack was "complex" and that it had "discovered additional points of compromise", without giving further details. The new disclosure comes as the exchange and the wider crypto industry try to recover from the largest hack in the history of digital assets, a theft that has deepened a security crisis for a sector already facing a wave of cyberattacks. Artificial intelligence is heightening the threat by giving criminals new tools to find vulnerabilities and trick employees, raising the risks for platforms that safeguard billions of dollars in digital assets.
In the hours after the attack, stablecoin issuers Tether and Circle Internet Group and other entities quickly froze or prevented the hackers from moving almost $3bn in funds, while analytics firms raced to trace the flow of cryptocurrencies and eventually attributed the attack to North Korea, which has denied the accusation. Some traders took advantage of the market turbulence. Throughout the episode, Binance sought to reassure users and said it would bear the financial cost, though it suspended withdrawals for almost two days. Early on Sunday it began progressively allowing users to withdraw funds; it initially recorded billions of dollars in outflows, but the situation appears to have stabilised and on Tuesday it said hourly deposits had begun to exceed hourly withdrawals. Binance also said it had almost fully replenished the stolen cryptocurrencies using a combination of corporate treasury funds and two insurance funds, and that it is working with US authorities including the FBI, the Secret Service and the Department of Justice. The FBI, which stepped in shortly after the attack to help Binance, also attributed the breach to North Korean hackers. Despite the unprecedented hack, the market impact has been moderate: bitcoin initially fell more than 4 per cent to near $76,000, but the world's largest cryptocurrency has since recovered some losses and was trading at $77,400 on Tuesday.
What it means for Pakistan: For Pakistani users of Binance, the world's largest crypto exchange by volume, the attack is a reminder that even the biggest platforms can be breached through their own staff. Pakistan's Virtual Assets Regulatory Authority (PVARA) is still building the country's licensing regime for virtual asset service providers, and the Binance case underlines why staff security training, incident response and cooperation with law enforcement will need to be part of any licensing standard. Pakistani holders of the assets involved have no direct claim on the frozen funds, and the episode shows how quickly stablecoin issuers can immobilise stolen coins, a tool local regulators may want to study as they draft rules for exchanges operating in or targeting Pakistan.
