Jakarta, ThedailyID — Cryptocurrency exchange Binance has revealed how hackers allegedly stole US$6.34 billion in digital assets. The attackers reportedly used fake job interviews, malware, and the company’s internal artificial intelligence (AI) tools.
According to Binance’s latest findings, the attackers first accessed its systems during the summer of 2026. A company technician accidentally downloaded malware, exposing the employee’s identity and those of other team members.
The affected team was responsible for managing Binance’s cryptocurrency wallet infrastructure. As a result, the attackers gained information that helped them target other employees.
The hackers then posed as project directors and contacted another technician through a legitimate job-search platform. During the first video interview, one attacker impersonated a human resources representative.
For the second interview, the attackers switched to a messaging application. One of them claimed to be the CEO of a fictional company and persuaded the technician to download malware onto his computer.
The operation reportedly began in June 2026, followed by the recruitment scam in September. It eventually led to an attack on Binance’s hot wallets, which are digital wallets connected to the internet.
On October 20, the attackers allegedly used compromised computers and Binance’s internal AI tools to take control of systems belonging to two employees. One was the initially targeted technician, while the other was a developer responsible for digital wallets.
The attackers then used the second developer’s computer and credentials stolen from the first technician. They subsequently ran malicious scripts to carry out the attack on October 29, 2026.
“This should not have happened, and we apologize for the concern, disruption, and uncertainty caused to our users, partners, and the wider industry,” Binance said, as quoted by The Guardian on November 3.
Meanwhile, the FBI has accused North Korea of being behind the cyberattack. Fake job interviews involving deepfake technology have reportedly been among the methods associated with the country’s cyber operations.
However, North Korea typically uses this tactic in reverse. Alleged operatives pose as IT professionals seeking employment at foreign companies, with the aim of funneling money back to Pyongyang.
North Korea rejected the accusations. Kim Yo-jong, the sister of leader Kim Jong-un, described them as “absurd rhetoric” and accused Washington of maintaining a hostile stance toward Pyongyang.
Kim also criticized the FBI’s claims that North Korean-backed hacking organizations were involved in the incident. She said the United States was misleading international public opinion by attributing cybercrimes around the world to North Korea.
