Binance has detailed how hackers carried out a $6.3bn theft from the world’s largest cryptocurrency exchange, describing an operation that combined malware, fake recruitment activity and the use of an internal AI tool. The company said the compromise developed over several months before attackers accessed hot wallets and removed billions of dollars in crypto-assets last week.
The breach, involving Binance, began in June with the inadvertent download of malicious software. That initial foothold was followed in September by a recruitment-related deception involving bogus job interviews. The company’s account indicates that the operation was not a single intrusion but a staged campaign designed to move from access to exploitation inside a major cryptocurrency platform.
Hot wallets are used by exchanges to keep digital assets available for transactions, making them operationally important but more exposed than offline storage systems. The theft therefore underlines a central security challenge for large trading venues: balancing speed of access for customers with the need to limit the amount of value reachable through internet-connected infrastructure. In this case, the stolen assets were valued at $6.3bn, or about £4.7bn.
The use of bogus hiring processes adds another layer to the incident. Recruitment scams have become a recurring tactic in cybersecurity incidents because they can place malicious files, links or communications in environments where employees expect to interact with unfamiliar people. Binance also said an internal AI tool formed part of the attackers’ method, a detail likely to draw attention within the wider technology and financial sectors as companies assess how workplace automation can be protected from abuse.
For the digital asset industry, the episode is significant not only because of the amount taken but because it targeted the best-known exchange operator in the sector. Large platforms depend on customer trust, internal controls and rapid detection systems to maintain confidence in trading and custody services. Binance’s description of the timeline shows how a breach can evolve across months, from a malicious download to social engineering and then to the final movement of funds.