Hackers used bogus job interviews to compromise a Binance engineer’s computer, then exploited an internal artificial intelligence tool to extend their access before stealing $6.3bn (£4.7bn), the cryptocurrency exchange has said.

Binance’s initial findings describe a chain of deception that reached three engineers’ computers and enabled attackers to drain the platform’s own wallets. The theft is thought to be the largest cryptocurrency hack to date.

The engineer was approached through a legitimate job-hunting platform and invited to interviews with people posing as company representatives. Binance said they built trust by sharing social media accounts containing personal photographs.

During a second interview, the engineer was instructed to download an apparent assignment. It contained malicious software whose code was concealed to evade detection, the company said. In October, attackers used the compromised computer and an internal AI tool that had also been compromised to gain control of two other engineers’ laptops.

The account describes social engineering: manipulating people into taking actions that open access to protected systems. Here, Binance says, a recruitment exercise became the entry point for a wider intrusion.

The world’s largest cryptocurrency exchange suspended withdrawals globally, leaving customers unable to remove their cryptocurrency until services resumed on Sunday. Users withdrew billions of dollars’ worth of assets after the platform reopened.

Binance apologised, saying “this should not have happened”. It said it had set aside more than 100% of the funds needed to cover the loss and that 98% of the affected token assets had been “replenished” by Saturday. Those measures address the shortfall; they do not establish that the stolen assets have been recovered.

The Federal Bureau of Investigation and US Secret Service have been helping trace the cryptocurrency. US agencies and cyber analysts said the attack bore signs of North Korean involvement. On Tuesday, Binance cited the FBI’s latest information as identifying North Korea as responsible.

Pyongyang denied responsibility that day. Kim Yo Jong, a senior official and sister of leader Kim Jong Un, described the accusations as another “sinister attempt” by the US to damage the country’s public image. North Korea has consistently denied responsibility for major cyber attacks attributed to it. The TraderTraitor unit, also known as the Lazarus Group, was blamed for the then-record $1.5bn Bybit theft in 2025.

Binance said it was working with law enforcement to trace and freeze assets, commissioning an external security review and planning a security research fund and joint initiatives. It also intends to invest more in AI threat-detection tools: its account places AI both within the compromised systems and among its proposed defences.