Binance has revealed new details about a major cyberattack that resulted in the theft of $6.34 billion in cryptocurrency. The investigation found that hackers used fake job interviews, infected software, and an internal artificial intelligence tool.
The cryptocurrency exchange released its findings after investigating the October 29 attack. According to the report, the attackers spent several months preparing before executing the theft.
Binance said it had replaced approximately 98% of the affected assets using its own funds. However, the remaining amount involves less frequently traded cryptocurrencies. These digital assets are harder to purchase and replace.
The company also reported that around $2.85 billion of the stolen funds had been frozen. This prevented the attackers from spending or converting those assets.
The theft took place over approximately four hours on October 29. The United States Federal Bureau of Investigation (FBI) blamed hackers affiliated with North Korea.
However, North Korea rejected the allegations. Kim Jong Un’s sister described the accusations as “absurd rhetoric.”
Binance is the world’s largest cryptocurrency exchange by daily trading volume. News of the incident triggered significant declines across several major cryptocurrencies. The breach is also believed to be the largest cryptocurrency theft recorded.
According to the investigation, the attackers started preparing their operation in June. They initially targeted an engineer working at Binance.
The hackers convinced the employee to download a compromised version of Homebrew. It is a popular software package manager commonly used by developers.
Although Binance’s cybersecurity team detected and removed the malware, the attackers had already collected valuable information. This included details about the targeted employee and other colleagues.
The attackers later launched another operation against a different engineer.
In September, they contacted another Binance engineer through a legitimate recruitment platform. They offered an interview for a position at a company that did not actually exist.
To make the opportunity appear genuine, the hackers shared social media photographs and videos. After gaining the engineer’s trust, they requested a technical assignment.
The assignment contained malicious software designed to hide its activities and avoid security detection. It also replaced a legitimate component of a development tool with an infected version.
This allowed the attackers to establish an important connection to Binance’s internal systems.
On October 20, the hackers used their existing access alongside an internal AI tool. They compromised software used by two additional engineers.
Nine days later, on October 29, the attackers activated the malicious code. They then carried out the cryptocurrency theft within approximately four hours.
The investigation highlights how cybercriminals can exploit recruitment processes and trusted software. It also raises concerns about the security of internal artificial intelligence tools.
In other related news also read Binance Chief Zhao Pardoned by Donald Trump
The incident demonstrates the importance of stronger cybersecurity measures. Companies must carefully verify recruitment opportunities, software downloads, and access to internal systems.
