The hackers behind the record-breaking Binance theft used fake job interviews and false business identities to gain access to company computers. The attackers spent weeks building trust with an engineer before convincing the employee to download malware disguised as an interview task.
Binance revealed the details of the operation on Tuesday. The company said the attack was part of a wider campaign that lasted several months. Hackers targeted multiple employees and gradually gained access to systems used to approve cryptocurrency transactions.
The fake recruitment process involved two rounds of interviews. During the first stage, a person claiming to work in human resources contacted an engineer. The individual shared social media details and other information to appear genuine and gain the employee’s trust.
The hackers later introduced another person who claimed to be the chief executive of a fake company. This person asked the engineer to complete an assessment as part of the hiring process.
The task required the employee to download a file onto a work computer. However, the file contained malicious software that allowed the attackers to gain access to the device.
Binance co-CEO Richard Teng described the operation as a complex attack. In a social media statement on Monday, he said the hackers also used a self-destruct system to remove their tools and traces of activity.
The company stressed that the incident did not result from one mistake or a single security breach. Instead, the attackers used several methods over a long period to reach their target systems.
Binance said the wider campaign began in June. During the early stage, another engineer downloaded a popular artificial intelligence coding tool. The company later discovered that additional employee devices had also been compromised.
The hackers continued to expand their access before reaching systems linked to wallet transaction approvals. These systems were important because they played a role in authorizing the movement of digital assets.
A major development occurred on October 20. Binance said the attackers used the engineer’s laptop, which had been compromised during the fake interview process, to access two other employees’ computers.
The company also confirmed that an internal AI tool was used during the operation. However, it did not explain how the hackers accessed or used the tool.
Several days later, the attackers used stolen login details to activate the malware responsible for the unauthorized transfers. This allowed them to carry out the theft through systems connected to cryptocurrency transactions.
Binance initially believed that a compromised laptop was at the center of the incident. However, a broader investigation uncovered several security problems involving different devices and employees.
The attack caused major disruption to the cryptocurrency exchange. Binance temporarily stopped withdrawals late last week while its security teams worked to understand the incident and protect customer assets. The service returned on Sunday.
The company also moved quickly to address concerns about financial losses. Shortly after the attack, Binance announced that it would cover all affected customer funds through its Secure Asset Fund for Users.
The fund is designed to provide financial protection for users during serious security incidents. Binance said customers would not have to bear the losses caused by the attack.
Stablecoin issuers Tether and Circle also helped limit the movement of stolen funds. They managed to freeze slightly less than half of the affected assets, making it harder for the attackers to transfer or use that portion.
By late Sunday night Eastern Time, Binance reported that it had processed $4.649 billion in withdrawals and approximately $1.01 billion in deposits. The figures showed that users had resumed activity after the temporary suspension.
The exchange also said it had replenished 98% of the affected assets. It maintained that all customer funds were covered and that normal services had returned.
Binance founder Changpeng Zhao, widely known as CZ, discussed the incident during an interview with Yahoo Finance on Tuesday morning. He described the response as a hectic process but said the platform was operating normally again.
Zhao said withdrawals had been restored and customers were free to use the exchange without major problems. He also stressed that users had not suffered financial losses because Binance had covered the affected funds.
The incident has raised fresh concerns about security across the cryptocurrency industry. It shows how hackers can target employees through social engineering rather than relying only on technical weaknesses.
Fake job offers can provide criminals with an opportunity to build trust before introducing harmful files. Attackers may also use false professional profiles and convincing company details to make their requests appear legitimate.
The Binance case highlights the risks of downloading files from unknown sources, even when they appear to be part of a normal business process. It also raises questions about employee device security and access controls.
Binance has not released every technical detail of the attack. However, its findings show that the hackers used a long-term strategy involving several employees, stolen credentials and malicious software.
The investigation may provide further information about how the attackers gained access and moved through the exchange’s internal systems. For now, the company says customer funds are protected and its services have returned to normal.
