Binance says fake job interviews used as part of $6.3bn crypto hack

ByLiv McMahon Technology reporter.

Key points

• The TraderTraitor unit, which is additionally known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.
• Hackers who stole a record $6.3bn (£4.7bn) from Binance applied fake job interviews and a compromised internal AI tool, the firm has disclosed.
• US crime agencies, including the Federal Bureau of Investigation (FBI) and Secret Service, have been assisting Binance in tracing the crypto taken from the platform's own wallets.
• The record $6.3bn (£4.7bn) attack is thought to be the largest crypto hack to date.
• Why North Korea's 'elite' hackers are the prime suspect in major Binance hack.

Initial findings published by the firm. It operates the world's largest cryptocurrency exchange, stated hackers gained access to its systems through "sophisticated, multi-stage campaign".

It remarked they employed a range of techniques such as malicious software downloads to compromise the computers of Binance engineers and gain control over tools to drain its wallet of billions of dollars worth of crypto.

Binance called it a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened".

In a post on X, external, Binance remarked hackers targeted its engineers using social engineering techniques.

These see hackers employ approaches such as phishing to trick residents into parting with sensitive or personal details, that can then be applied to try and access their accounts.

Binance remarked as part of the hack, one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake business representatives.

It remarked the perpetrators employed "more advanced and deceptive" methods to build trust with him, such as sharing social media accounts that contained personal images.

Notably, the engineer in question was instructed to download malware masquerading as an "assignment" during a second interview, that deployed malicious code with "obfuscation techniques" evading detection.

Binance remarked hackers then leveraged the engineer's compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops, and execute the next steps of the attack.

In practice, the incident led Binance to suspend withdrawals for customers globally, meaning users could not obtain their cryptocurrency out of the platform until the service was restored on Sunday. Customers withdrew billions of dollars worth of assets after it reopened.

"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry, " it remarked.

For context, the firm went on it had taken a range of steps after the incident, including working with law enforcement to trace and freeze affected assets.

It remarked it had additionally set aside more than 100% of the funds needed to cover the loss, noting 98% of the token assets impacted had been "replenished" as of Saturday.

Meanwhile, the record $6.3bn (£4.7bn) attack is thought to be the largest crypto hack to date.

In practice, the agencies, along with a range of cyber analysts, remarked that the hack – like similar breaches before it – bore the signs of having been orchestrated by North Korea.

Pyongyang hit back at the claims on Tuesday, denying it was behind the hack.

Kim Yo Jong, a top Democratic People's Republic of Korea official and the sister of leader Kim Jong Un, remarked on the accusations were another "sinister attempt" by the US to damage North Korea's public image.

For context, the country has consistently denied being behind a number of major cyber attacks it has been blamed for over recent years.

Notably, the TraderTraitor unit, which is additionally known as the Lazarus Group, was blamed for a then-record $1.5bn hack of crypto exchange Bybit in 2025.

Binance had previously not responded to the BBC's queries regarding North Korea's alleged involvement in the hack.

But on Tuesday, the firm wrote in its post on X, external: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."

As well as engage third-party cyber experts to carry out a full-scale review of the incident, as part of its security efforts after the attack, Binance stated it would additionally rise investment in AI tools that can detect security threats.

According to It additionally, it would seek to stablish a security research fund and work with leading AI and security firms on targeted initiatives.

Why North Korea's 'elite' hackers are the prime suspect in major Binance hack. From Bitcoin to Binance: Crypto terms and what they mean.

Who could be behind the Binance hack and what we know so far.

Taken together, the developments around binance says fake job interviews used as part of $6.3bn crypto hack point to a situation that is still moving, and the coming days should bring more clarity.