Cryptocurrency platform Binance has said fake job interviews and an internal artificial intelligence tool were used for the massive $6.3 billion breach it reported last week.
The culprit leveraged the compromised computer of one of its engineers and used an AI tool to gain control of the wallets of two other engineers, Binance said in a post on Tuesday.
That was “used as a springboard” on October 20, as “the attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method”, the company said.
Preparations for the theft stretched as far back as June, traced to a supply chain attack in which an engineer downloaded a tampered Homebrew installation to install a popular AI coding tool after finding it on a search engine, Binance said.
Homebrew is software that allows users to easily install apps, particularly for Apple's macOS and Linux. Binance did not identify the AI coding tool and the search engine that were used.
By September, Binance had determined a social engineering attack – one in which someone is deceived into revealing sensitive information – hit one of its engineers through a legitimate job-hunting platform, with someone posing as a project director. It culminated in instructing the engineer to download an “assignment” that contained a malicious code, Binance said.
Binance also said it has taken measures to protect its systems, including rebuilding the affected wallet system in a new environment and internal AI tools and access controls.
It has also replaced affected devices and decommissioned credentials and tokens related to the affected engineers, and continues to work with law enforcement, blockchain intelligence companies and industry partners to trace and freeze the affected assets.
Further action includes independent cybersecurity reviews with independent third-party experts to study the incident, expanded investment in AI security and prevention, and working on a security research fund and other industry initiatives to protect against such attacks.
“We will continue to strengthen our measures as the investigation progresses,” Binance said. “There are a number of security measures we have implemented and are implementing that will remain private to prevent malicious actors from compromising our security.”
Binance lost an estimated $6.3 billion to hackers last Friday, in what has been described as the single biggest theft of crypto on record, exceeding the $1.5 billion stolen from Bybit in February 2025.
The company, founded by Changpeng Zhao, previously said it would absorb the financial impact of the stolen funds rather than passing the losses on to customers. It resumed withdrawals on Sunday as investigations were under way.
The FBI on Saturday attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. Members of the group were observed by law enforcement converting the stolen assets into ether, the FBI said in a statement, adding that it expected further laundering through related technology.
