Richard Teng is the CEO of Binance.
Ore Huiying/Bloomberg via Getty Images
Binance said fake job interviews helped hackers breach its systems.
Hackers stole $6.3 billion in crypto from the company last month.
The FBI has blamed North Korea for the record crypto heist.
Bogus job interviews were among the methods hackers used to infiltrate Binance before pulling off the biggest crypto heist in history, the company said on Tuesday.
Binance, the world’s largest cryptocurrency exchange, detailed the findings in an initial report on how hackers accessed the company’s wallets ahead of the October 29 theft of $6.3 billion in crypto.
Richard Teng, the CEO of Binance, said in an X post on Tuesday that the hack was the result of a “months-long campaign” and called it “one of the most sophisticated attacks the digital asset industry has ever seen.”
The FBI has said North Korean hackers were behind the theft, though the country has denied any involvement.
According to Binance, the heist operation began in June when an engineer on its wallet infrastructure team downloaded a tampered version of an AI coding tool.
The company said its security team detected the issue, replaced the device, and changed all related credentials, but the employee’s role and those of his colleagues were exposed to hackers.
On 29 October, Binance was the target of one of the most sophisticated attacks the digital asset industry has ever seen. ~$6.34B in assets were impacted. We take full responsibility and we’re making it right.
No user bears the loss. We set aside more than the full amount required. At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.
This wasn’t one mistake or one breach – it was a months-long campaign. We’re publishing the full report because the lessons go far beyond Binance.
~$2.85B has already been frozen or intercepted with law enforcement, issuers and blockchain intelligence firms. The speed of coordination could not be matched in traditional finance.
— Richard Teng (@_RichardTeng) November 3, 2026
In September, one of Binance’s software engineers was contacted through what the company said was a “legitimate job-hunting platform by an individual posing as a Project Director.”
That employee had a profile on the platform that referenced his experience at Binance, the crypto exchange said.
“The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company,” Binance said.
The Binance engineer completed a video interview with the fake HR rep, who shared a social media account with the employee filled with personal photos and videos “in order to build trust,” the company said.
During the second interview, which was conducted in a “popular social chat app,” Binance said the engineer was instructed to download an “assignment” that contained a “malicious code repository onto his work computer.”
“The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities,” said Binance.
The company said that on October 20, the hackers leveraged the engineer’s compromised computer and used an internal AI tool to gain control of the systems used by two other engineers on its wallet team.
On the day of the heist, “the attacker logged onto Software Engineer C’s computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack,” Binance said.
Binance said Tuesday that it’s bringing on third-party cybersecurity experts to further review the incident, increasing its investment in AI-enabled detection, and working to establish a research fund with AI companies focused on AI security in blockchain systems.
Read the original article on Business Insider
