Binance’s new account of the October theft describes attackers targeting employees over several months and using an internal AI tool to extend their access. The exchange says compromised devices and fake recruitment interviews formed part of the campaign. Its account also describes why suspending normal withdrawals did not immediately halt every unauthorised movement of funds.
Cryptocurrency exchange Binance has published an account linking the theft to fake recruitment interviews and use of its own internal artificial intelligence tool.[1], [2]
According to Binance, attackers used the AI tool by October 20 to extend access associated with two other employees. The theft followed on October 29. The company’s account gives limited detail about the tool’s permissions or its role in expanding access.[1]
Binance traces the preparations to June, when an employee downloaded a tampered installer. Its security team detected the malware and replaced the device, the company says, but information about engineers’ roles and working relationships had already been exposed. In September, a second engineer was targeted through a supposed recruitment process. Binance says that compromise escaped its endpoint security tools at the time.[1]
The exchange says its wallet arrangement and previously established on-chain permissions complicated efforts to stop unauthorised transfers after normal withdrawals were halted. Chief executive Richard Teng says users will not bear the losses. Binance reports about 2.85 billion dollars in assets frozen or intercepted and says 98 per cent of affected tokens have been replenished, with work continuing on the remainder.[1]
