(Seoul, South Korea) – Binance says attackers used fake job interviews and a compromised internal artificial-intelligence tool to reach its cryptocurrency wallet systems before stealing approximately US$6.34 billion in digital assets on October 29.

The exchange’s initial investigation report, published November 3 and independently covered by NPR, Bloomberg and Yonhap, provides a substantially fuller account of how the theft unfolded. The new development is the disclosure of the attackers’ methods and planned security review, rather than a newly discovered theft.

According to Binance, the operation stretched over several months. A June compromise exposed information about employees working on its wallet infrastructure, even though the company detected that intrusion and replaced the affected device.

In September, another engineer was approached through a legitimate job-hunting platform by someone posing as a recruiter. Interviews with purported company representatives followed. NPR reported that the approach included social-media accounts, personal photographs and videos intended to establish trust.

The engineer was eventually asked to download a recruitment assignment onto a work computer. Binance says the assignment contained malicious software that its endpoint security tools did not detect.

The exchange says attackers subsequently used an internal AI tool to expand their access to other engineers’ systems, then obtained credentials that helped them reach the service used to authorize wallet transactions.

Binance also explained why suspending customer withdrawals did not immediately stop every unauthorized transfer: permissions already established on Ethereum operated separately from its normal withdrawal infrastructure and required additional action to revoke.

The FBI has attributed the theft to North Korean hackers known as TraderTraitor. Yonhap reported November 4 that North Korea rejected the attribution. Responsibility remains an official U.S. allegation, not a court finding.

Binance says it will absorb the financial losses rather than pass them to users. It reports approximately US$2.85 billion in assets frozen or intercepted, while cautioning that the figure remains subject to reconciliation and market-price changes.

The company says affected systems have been rebuilt or replaced and independent cybersecurity specialists are being engaged. Its investigation remains preliminary; the announced outside review has not yet produced public findings.

Accompanying image: editorial illustration.

Sources