Technology news and discussion on TalkFuse.
Binance says fake recruitment and AI tool aided $6.3bn crypto theft
Developing story first seen 2 hours ago
The new details in Binance’s postmortem describe how attackers reportedly used a fake recruitment process and malware to compromise staff before stealing about $6.3 billion in cryptocurrency. The account matters because it shows how social engineering and compromised developer software can be combined to reach wallets, while leaving questions about the security of Binance’s internal AI tool.
Binance says one engineer downloaded a tampered installer in June, while another was targeted in September through staged interviews and a malicious coding assignment. The attackers allegedly replaced the pyenv development tool to gain backdoor access, then used Binance’s AI tool to access wallets by 20 October and began transferring funds on 29 October. The FBI has attributed the attack to the North Korean group TraderTraitor; Binance says $2.85 billion was frozen or intercepted, 98 per cent of affected tokens had been replenished, and withdrawals had broadly resumed.
- Sources
- 3
- Outlets
- 3
- Left · Centre · Right
- 0 · 0 · 0
In short
- Binance says a fake recruitment process helped attackers install malware.
- The company links the theft to North Korean group TraderTraitor.
- Binance says $2.85 billion was frozen or intercepted.
How this story developed
- 34 minutes ago Binance added that a malicious Google advert exposed staff details before a tampered installer was downloaded in June, and said the stolen assets were frozen or intercepted, affected tokens replenished and withdrawals broadly resumed.
- 38 minutes ago Binance reported that attackers used a fake recruitment process and malware to compromise staff, then accessed wallets through its internal AI tool and stole about $6.3 billion in cryptocurrency.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The reported breach supports the case that Binance’s safeguards around developer access, internal AI tools and wallet controls deserve close scrutiny: attackers reportedly used compromised staff devices and the AI system before stealing a very large sum. Users and the wider market have a legitimate interest in knowing whether stronger controls could have prevented the theft, and in receiving clear evidence about the recovery and replenishment of affected assets.
The case against
Binance’s account also points to a sophisticated attack exploiting employees through malicious advertising, fake recruitment and tampered development software, rather than a simple failure of one safeguard. The reported freezing or interception of much of the stolen value, replenishment of most affected tokens and broad resumption of withdrawals may support the view that the response contained the damage, while the available details do not yet establish exactly which controls failed or whether the AI tool itself was inadequately protected.
Explained simply
Binance is a cryptocurrency exchange, a service where people trade and store digital assets. Its engineers help build the software behind the exchange, so access to their work systems can create risks for the wider service.
Fake recruitment approaches can trick staff into opening harmful files, while malware can let attackers enter or monitor a computer. Development tools help engineers build software; if one is tampered with, it can provide a route into systems that handle digital assets.
The account highlights how staff-targeting scams and compromised tools can combine with access to an organisation’s internal technology. It also raises questions about how companies protect sensitive systems, including AI tools, from misuse.
Coverage · 3 sources
AI Business Companies Crypto Cybersecurity Software Technology
Read the full article at the source →
Originally published by The Verge as “Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist”.