Hackers who stole a record $6.3bn (£4.7bn) from Binance used fake job interviews and a compromised internal AI tool, the firm has revealed.
Initial findings published by the company, which operates the world’s largest cryptocurrency exchange, said hackers gained access to its systems through “sophisticated, multi-stage campaign”.
It said they used a range of techniques such as malicious software downloads to compromise the computers of Binance engineers and gain control over tools to drain its wallet of billions of dollars worth of crypto.
Binance called it a “serious and highly sophisticated security incident” and apologised, saying “this should not have happened”.
In a post on X, external, Binance said hackers targeted its engineers using social engineering techniques.
These see hackers use approaches such as phishing to trick people into parting with sensitive or personal details, that can then be used to try and access their accounts.
Binance said as part of the hack, one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives.
It said the perpetrators used “more advanced and deceptive” methods to build trust with him, such as sharing social media accounts that contained personal images.
The engineer in question was instructed to download malware masquerading as an “assignment” during a second interview, that deployed malicious code with “obfuscation techniques” evading detection.
Binance said hackers then leveraged the engineer’s compromised computer and a compromised internal AI tool in October to gain control over two other engineers’ laptops, and execute the next steps of the attack.
The incident led Binance to suspend withdrawals for customers globally, meaning users could not get their cryptocurrency out of the platform until the service was restored on Sunday.
Customers withdrew billions of dollars worth of assets after it reopened.
“We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” it said.
The company added it had taken a range of steps following the incident, including working with law enforcement to trace and freeze affected assets.
It said it had also set aside more than 100% of the funds needed to cover the loss, noting 98% of the token assets impacted had been “replenished” as of Saturday.
The record $6.3bn (£4.7bn) attack is thought to be the largest crypto hack to date.