North Korean Hackers' Fake Job Interviews, AI Made $6.3 Billion Binance Heist

There is a delicious irony in the fact that a crypto firm known for its attempts to evade regulation and taxes was hacked and ripped off by a North Korean government known for its expertise in exploiting in firms' security defenses. Karma. JL

Cris Tolomia reports in Quartz:

Binance said hackers from North Korea used fake job interviews and malicious software to steal $6.3 billion from the exchange. The attack began in June, when a staffer who builds Binance's wallets installed a doctored AI tool. Binance spotted the problem and swapped out the device, though the hacker learned the employee's role and those of others on the wallet team. In September, someone posing as a project director approached a second software engineer through a job hunting platform. That engineer took part in an interview on a social messaging app with someone posing as the CEO of an invented company, and was told to download an assignment that held a "malicious code repository." On Oct. 20, the attackers leveraged an internal AI along with the second engineer's infected computer to seize command of the devices belonging to two other engineers. On Oct. 29, the attackers logged in with stolen credentials and ran a malicious script that kicked off the theft,

Binance said Tuesday that hackers it attributes to North Korea used fake job interviews and malicious software to steal $6.3 billion from the exchange, according to Bloomberg. The company called the breach a "sophisticated, multi-stage campaign" in an incident report published Tuesday, Bloomberg reported. 

The attack began in June, when a staffer who builds Binance's wallets installed a doctored AI tool, according to NBC News. Binance spotted the problem, swapped out the device and reset credentials, though the hacker still learned the employee's role and those of teammates on the wallet team, NBC News reported.

In September, someone posing as a project director approached a second software engineer through a job hunting platform, according to Bloomberg. That engineer then took part in an interview on a social messaging app with someone posing as the CEO of an invented company, and was told to download an assignment that held a "malicious code repository." 

On Oct. 20, the attackers leveraged an internal AI tool along with the second engineer's infected computer to seize command of the devices belonging to two other engineers, according to The Block $SQ NaN%. Then on Oct. 29, the attackers logged in with stolen credentials, set up a container and ran a malicious script that kicked off the theft from the wallet, The Block reported.

“This was not a single mistake or a single breach. It was a campaign built over many months,” Binance Co-CEO Richard Teng said, according to Bloomberg. Teng said the attackers blended sham hiring interviews, malware posing as genuine developer tools, hijacked devices and AI-driven methods.

About $2.85 billion in assets has been frozen or intercepted by Binance, which has also restored 98% of the affected assets, according to The Block. Binance has said it is reimbursing every customer who lost money, according to NBC News. 

The exchange paused withdrawals after the incident and began letting users take out funds again on Sunday, according to Bloomberg. By Tuesday, deposits per hour had begun to outpace withdrawals per hour, Bloomberg reported.

Binance said it has shut the entry points the attackers exploited, replaced or rebuilt the systems that were hit, tightened controls on devices and broadened its AI-based anomaly detection, according to The Block. It also said it caught and stopped 57 attacks in 2026 that it suspects were tied to North Korea, many of which relied on comparable methods.

The FBI has attributed the breach to North Korean hackers, according to Bloomberg. North Korea has denied the claim. On Monday, the sister of North Korean leader Kim Jong-un called the FBI's claims a "grave political provocation," according to The Block.