Binance has announced that hackers utilized phishing job interviews and a breach of an internal artificial intelligence (AI) tool to execute what is considered the largest heist in cryptocurrency history, amounting to approximately $6.3 billion (£4.7 billion). In preliminary findings revealed by the world's largest cryptocurrency trading platform, Binance, hackers gained entry through a "sophisticated, multi-stage campaign."
The heist began in September when a hacker approached an engineer via a reputable job-finding platform, luring him into fake interviews with fraudulent company representatives. Hackers built trust by using social media accounts featuring fabricated profiles, eventually convincing the engineer to download malware disguised as an "assignment" during a second interview.
Binance explained that the hackers leveraged the compromised computer and its internal AI tool to gain control over two additional engineers' systems. This breach led to a global suspension of withdrawals by Binance; once services resumed, withdrawals reached several billion dollars.
The investigation is currently being supported by the Federal Bureau of Investigation (FBI) and the US Secret Service, while US authorities attribute the hack to North Korea, which denies the allegations. TRM, a blockchain analytics firm, has attributed the hack to the North Korean group known as "TraderTraitor" with high certainty.
Tether, Circle, Ripple, and World Liberty Financial have frozen $2.7 billion in stablecoins, while the hackers retain control of $2.4 billion in assets. Binance stated it has provisioned over 100% of the required funds to cover losses, with 98% of token assets restored.
Former Binance CEO Changpeng Zhao expressed concern over AI's role in cyberattacks, stating: "There is no other solution but to use AI to fight AI attacks." The incident highlights the growing vulnerability of corporate internal tools to social engineering tactics. Security experts suggest that this breach serves as a wake-up call for the tech industry regarding the security of remote work environments.
The use of AI-generated profiles and deepfake technology in recruitment scams is becoming increasingly common. Binance has since implemented stricter security protocols for its internal systems, including mandatory hardware security keys for all engineers.
The platform continues to work with international law enforcement agencies to track the remaining stolen funds. As the investigation continues, the crypto community remains on high alert.
The scale of this theft underscores the risks associated with centralized exchanges and the sophisticated nature of state-sponsored cyber warfare. The company has promised full transparency as the forensic audit of its internal systems concludes.
Investors are being urged to remain cautious and monitor their accounts for any suspicious activity following the platform's security overhaul.