Binance Says Hackers Stole $6.34 Billion Using Fake Interviews and Internal AI Tool
Binance Reports $6.34 Billion Crypto Theft
Binance disclosed that hackers used fake job interviews and an internal artificial intelligence tool in a cyberattack that resulted in the theft of more than $6 billion in digital assets last week. [1] The exchange reported that approximately $6.34 billion in digital assets were affected by the incident. [4] The multi-stage operation was suspected of being carried out as early as June. [1] Binance said the theft occurred last week according to its findings released on Tuesday. [4]
Attack Leveraged Fake Interviews and Malware
The multi-stage operation involved fake interviews and an internal AI tool. [1] In September, a fake recruiter on a job platform ran video interviews and sent an "assignment" repository carrying 0-day malware undetected by endpoint tools. [4] Binance described the initial phase as beginning as early as June with the social engineering component unfolding in September. [1] The exchange detailed how the assignment repository was delivered during the video interviews to introduce the undetected malware. [4]
Internal AI Tool Used as Springboard
According to Binance, the attacker used an internal AI tool on Oct. 20 as a springboard to reach a container deployment token and later deployed a container to trigger the attack. [1] The exchange explained that this step allowed the attacker to escalate access within its systems on that specific date. [4] Binance noted the internal AI tool served as the key escalation point after the earlier malware delivery. [1] The deployment of the container followed directly from the token access obtained via the AI tool on Oct. 20. [4]
FBI Attributes Hack to North Korean Group
The US Federal Bureau of Investigation has attributed the theft to North Korea, identifying the incident with a North Korean hacking group it calls TraderTraitor, a name previously tied to other cryptocurrency thefts. [1] Binance said it blocked 57 suspected North Korea-linked threats this year. [4] The FBI's attribution connects the breach to the group known as TraderTraitor based on prior cryptocurrency theft patterns. [1] The exchange's report included its own count of 57 blocked threats tied to the same suspected actors. [4]
North Korea Rejects Allegations
On Tuesday (Korean time), Kim Yo-jong, the powerful sister of North Korean leader Kim Jong-un, flatly dismissed the findings of the FBI, calling it a "grave political provocation" against Pyongyang. [1] The US State Department reiterated concerns over North Korea's use of cybercrime to finance its weapons programs. [4] A US State Department spokesman told Yonhap News Agency that the issue of DPRK cybercrime is a global problem that touches companies and jurisdictions around the world, including the United States. [1] The spokesman referred to North Korea's official name, the Democratic People's Republic of Korea, when addressing the department's position. [4]
What to watch next: The US State Department has signaled continued monitoring of DPRK cybercrime as a global issue affecting multiple jurisdictions, while Binance maintains its internal tracking of suspected North Korea-linked threats.
