Binance disclosed detailed information about a cyberattack that resulted in the theft of $6.3 billion (approximately R$ 34.5 billion) in cryptocurrencies. The intruders employed social engineering tactics, manipulated artificial intelligence tools, and an internal AI feature of the exchange itself.
This incident, recorded on October 29, has the potential to be the largest financial theft ever documented. In a report published on Tuesday, the platform explained how criminals managed to compromise employees' computers and gain access to the systems managing digital wallets.
The operation began in June when a wallet development team member installed a tampered AI tool provided by the criminals. Although Binance detected the problem, replaced the equipment, and changed access credentials, the functions of this professional and other team members remained vulnerable to the intruders.
The strategy evolved in September. A second software engineer, seeking new employment, participated in a selection process that appeared authentic. This process included a video conference with the supposed CEO of a fictitious company, at which point the employee downloaded a malicious code repository onto their computer, compromising another device linked to the Binance wallet development team.
After gaining control of the employees' computers, the attackers utilized Binance's internal artificial intelligence tool. On October 20, they combined the use of the infected hardware with this internal feature to take control of the systems of two wallet developers.
It is important to note that the internal AI tool played a distinct role from the tampered program downloaded in June: while the first resource was used to compromise an employee's computer, Binance's internal system was used by the hackers to advance within the development environments.
The final phase of the attack occurred nine days later, on October 29. The intruder used the second developer's computer, along with stolen credentials from the first, to execute a malicious script that triggered the theft.
The FBI attributed the action to a hacking group, although this accusation was refuted by the North Korean government. Binance communicated that it is providing full refunds to customers who suffered losses during the invasion.
As a result of the incident, the exchange publicly apologized to affected users and partners. The company stated: 'This should not have happened, and we apologize for the concern, disruption, and uncertainty it caused our users, partners, and the industry as a whole.'
Additionally, Binance announced plans to increase investments in AI-based detection technologies. Planned initiatives include establishing a security research fund and developing specific projects in collaboration with leading AI companies.
