Sourced fact
The News
Binance, the giant digital currency trading platform, has revealed that a standard cyberattack valued at $6.3 billion was executed through the theft of customer funds using advanced technologies and employee deception, admitting that this serious security incident would not have succeeded without calculated external intervention.
In a statement posted on X, Binance stated that attackers targeted the company's engineers via legitimate job-hunting platforms to invite them to fake job interviews with representatives of fake companies to build trust before directing them to download malicious software.
The platform's spokesperson clarified that attackers used social engineering techniques such as phishing to deceive employees, and exploited one engineer's computer and a set of internal AI tools compromised in October to control other engineers' computers and execute subsequent stages of the attack.
These attacks prompted Binance to suspend digital currency withdrawal operations from its global vaults until Sunday to restore services, while companies dealing with the platform withdrew billions of dollars in assets immediately upon reopening services for customers.
The company indicated it took immediate actions including cooperation with law enforcement agencies such as the US Federal Bureau of Investigation (FBI) to trace and freeze stolen funds, and clarified that more than 98% of damaged assets had been compensated by Saturday.
Reports also indicated that US agencies and a cyber analysis expert confirmed that the attack bears the fingerprint of North Korea, similar to previous attacks, while Pyongyang denied any involvement in cyberattacks and accused the United States of attempting to destroy its public image through these accusations.
Although Binance previously did not respond to BBC requests regarding North Korean involvement, it recently announced adopting new information provided by the FBI indicating North Korea's responsibility for the incident.
In efforts to enhance future cybersecurity, the platform promised to increase investment in AI tools to detect security threats and hire independent cyber experts to conduct a comprehensive review of the incident while establishing a security research fund.
Analysis & context
Analysis & Context
From an analytical perspective, this attack represents a paradigm shift in the world of financial cybercrime, where hackers moved from merely breaching databases to targeting the platform's human and technical infrastructure through social engineering and artificial intelligence.
In the broader context, reports indicate that similar attacks targeting the cryptocurrency sector are often linked to countries such as North Korea, which possesses specialized units like the Lazarus Group (TraderTraitor), previously accused of hacking Bybit for $1.5 billion in 2025.
Pyongyang's response, denying involvement and describing accusations as a poor attempt by the United States, reflects continued geopolitical tension and the use of cyberspace as a tool for diplomatic and indirect military pressure against Western countries.
Additionally, Binance's decision to allocate more than 100% of funds needed to cover losses reflects a strategic shift in the cryptocurrency sector toward greater accountability and customer protection, especially after 98% of damaged assets were compensated by Saturday.
