Binance heist began with a fake job interview and an internal AI tool

The entry point: a fake job interview

Binance traces the start of the $6.34 billion attack to a fake job interview. Attackers are said to have used it to get inside the company and then advanced the operation through the firm's own AI tool.

This points to a social engineering attack that targets people rather than a technical flaw: a convincing-looking interview can open the door to an employee's access rights.

How the AI tool came into play

According to the disclosure, the internal AI tool played a role in spreading the attack. Such tools, wired into internal workflows, can carry broad access once an authorized user issues commands.

That shows AI-powered internal tools are becoming a new attack surface. The more systems a tool is connected to, the bigger the impact when it is compromised.

FBI: North Korea is behind it

The FBI attributed the attack to North Korea. The stolen amount exceeded $6 billion, and Binance had earlier said it reopened withdrawals and replaced most of the stolen funds.

What it means for readers

The incident concerns not only crypto exchanges but any company using AI tools. Hiring processes, permission boundaries for internal tools and oversight of employee access now sit at the center of security planning.