BarcelonaThe cryptocurrency exchange platform Binance has revealed that the cyberattack it recently suffered –with an estimated impact of 6.34 billion dollars (more than 5.6 billion euros)–, attributed by the United States authorities to North Korea, began with an infiltration operation through fake job interviews. In a preliminary report published on the social network X, the company—currently based in Malta—explained that the attackers used “social engineering” techniques, artificial intelligence (AI) tools, and advanced transaction authorization mechanisms to steal the assets.
“It was not a single isolated breach nor a simple identity theft incident,” noted Binance, which described a “sophisticated” operation developed in several stages. According to their reconstruction, in September a company engineer received a fake job offer and participated in two interviews, after which they downloaded a supposed technical exercise containing malicious code onto their work computer.
Subsequently, the attackers used an internal AI tool to compromise other computers and obtain credentials that allowed them to access the transaction authorization system. Thus, on October 29, they made unauthorized transfers of various cryptocurrencies, including bitcoins, XRP, and assets from the Solana and Ethereum networks.
Binance acknowledged that the suspension of asset withdrawals by its users was not enough to immediately stop the theft, due to malicious authorizations that allowed funds to be moved outside of its “usual infrastructure”. “This should not have happened and we apologize for the concern, disruptions, and uncertainty caused”, the company stated in the statement on X.
The platform ensures that it has already replaced 98% of the affected assets and has reserved enough funds to cover the losses caused by the cyberattack, while some 2.85 billion dollars (about 2.53 billion euros) remain frozen or have been intercepted. In the same vein, it announced an independent review of its security systems and that they will invest more in detection tools based on artificial intelligence.
Accusations against North Korea
On Saturday, the FBI, the US federal police, attributed the attack to the North Korean group TraderTraitor, although Pyongyang rejected the accusation this week and described it as “absurd”. The incident far exceeds the $1.5 billion theft suffered by Bybit in February 2025, also attributed to North Korean hackers.
Founded in Shanghai in 2017, Binance moved its operations out of China after restrictions imposed by Beijing and operates internationally without a single headquarters.
