Fake job interviews helped hackers pull off Binance's record crypto heist

Hackers behind the record-breaking Binance heist spent weeks masquerading as recruiters and fake executives, eventually convincing an engineer to download malicious software onto a work computer as part of a larger-scale ruse, the company said Tuesday.

Binance said the ploy included two rounds of interviews, with a supposed human resources representative conducting the first interview and sharing social media information to gain the programmer's trust. A second person, posing as the CEO of a fake company, later persuaded the engineer to download a file containing malware under the guise of an interview assessment.

"This was a complex attack," Binance co-CEO Richard Teng said on social media Monday. "The attacker also used a self-destruct mechanism that destroyed tooling and tracers."

The company emphasized that there was no single breach or mistake behind the hack, which is by far the largest crypto theft in history . Instead, the campaign unfolded over several months.

Binance hacked for record $6.3 billion, withdrawals suspended after "complex attack"

What Binance users should do right now following major hack

Binance's $6.3 billion hack: How the biggest crypto heist unfolded

The fake job interview was just one stage of the hackers' multistep attack. Binance said the campaign began in June, when another engineer downloaded a "popular AI coding tool." Additional employee devices were later compromised before the hackers gained access to systems involved in authorizing wallet transactions.

On Oct. 20, hackers used the engineer's laptop, which had been compromised during the fake interview process, to infiltrate two other employees' computers. Binance said the attackers also used an internal AI tool, though it did not provide further details on how the tool was used. Days later, they used stolen credentials to launch the malware responsible for the unauthorized transfers.

Binance's initial findings pointed to a compromised laptop, but a broader review revealed a wider series of security breaches. The company temporarily suspended withdrawals late last week before reopening them Sunday.

Hours after the hack, Binance said it would cover all customer losses using its Secure Asset Fund for Users . Stablecoin issuers including Tether and Circle ( CRCL ) were able to freeze a little less than half of the stolen assets.

By late Sunday night ET, the company said it had processed $4.649 billion in withdrawals and roughly $1.01 billion in deposits. Binance says it has since replenished 98% of the affected assets.

"It's been a pretty hectic process," Binance founder Changpeng Zhao, better known in crypto circles as CZ , told Yahoo Finance in an interview that aired Tuesday morning . "But the good thing is right now the withdrawals have been restored, the system's back to normal. People are free to use the platform without any issues now. And then all user funds are covered. The users did not suffer any loss."