What changed
Binance said hackers stole $6.3bn (£4.7bn) in October through a multi-stage attack that began with fake job interviews targeting an engineer. The alleged malware was disguised as an interview assignment, then a compromised internal AI tool helped the attackers reach two more engineers’ laptops and take control of wallets.
Binance suspended customer withdrawals worldwide and restored them on Sunday. It said 98% of affected token assets had been replenished by Saturday and that it held more than 100% of the loss in reserve.
Why it matters
The striking weakness here was not a broken vault door. It was a believable conversation. A job seeker was drawn through fake interviews, shown convincing social-media identities and given what looked like ordinary hiring homework.
That made one engineer’s computer the opening move in a much larger operation. The compromised AI tool then became part of the chain, helping the attackers spread to other laptops. For Binance, internal tools and employee trust were not separate from wallet security; they were part of the same perimeter.
The withdrawal freeze turned the breach into a customer-facing crisis. Users temporarily lost access to their crypto, and billions of dollars’ worth of assets moved after withdrawals reopened. Binance says it has reserved enough to cover the loss, but the full attack path, final loss allocation and independently confirmed recovery remain unsettled.
The FBI, Secret Service and cyber analysts are helping trace and freeze assets. They have said the attack bears signs associated with North Korea, while North Korea denies involvement.
Comments
No comments yet.