Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto

Binance Co-CEO Richard Teng Reveals $6.3 Billion Crypto Hack: How Hackers Used Fake Job Interviews and AI to Steal Billions The $6.3 billion crypto heist that shook the industry is now 98% resolved — but the attack vector exposes terrifying vulnerabilities in the Web3 ecosystem. ---

The Heist That Broke the Internet

Binance co-CEO Richard Teng confirmed on Tuesday that hackers executed a sophisticated multi-stage attack to steal $6.34 billion in crypto assets, exploiting fake job interview processes and an AI-powered tool to infiltrate the exchange's internal systems. The breach, which occurred in May 2023, remains the largest crypto hack in history and has fundamentally reshaped how exchanges evaluate third-party integrations and employee onboarding protocols. The attackers' initial entry point was remarkably mundane — they posed as recruiters and sent phishing emails to Binance employees conducting job interviews. Once inside the corporate communication channels, they deployed an AI tool capable of generating convincing social engineering scripts, fraudulent documentation, and deepfake audio to bypass security protocols. From there, the hackers moved laterally into the exchange's hot wallet infrastructure, siphoning approximately $6.3 billion in digital assets before detection. Binance has now replenished 98% of the stolen assets, according to the security report released alongside Teng's statement, recovering approximately $6.17 billion. The remaining 2% represents assets still frozen or under investigation, leaving a residual exposure of roughly $170 million. ---

How the Attack Unfolded: A Step-by-Step Breakdown

The hackers' methodology combined social engineering with technical exploitation in a way that no single security layer could have stopped. Here is how the attack chain operated: 1. Initial Access via Phishing: Hackers sent fraudulent job interview invitations to Binance employees, embedding malicious links in what appeared to be legitimate recruitment communications. 2. AI-Enhanced Social Engineering: Once employees engaged with the fraudulent communications, the attackers used an AI tool to craft personalized phishing messages at scale, making each email indistinguishable from genuine corporate correspondence. 3. Lateral Movement: After gaining access to employee credentials, the hackers pivoted into internal systems, exploiting weak two-factor authentication practices and insufficient network segmentation. 4. Hot Wallet Drain: The attackers targeted Binance's hot wallets — internet-connected wallets used for daily operations — which lack the cold storage protections of offline hardware wallets. This attack vector is particularly alarming because it exploited human trust rather than pure technical vulnerabilities. The use of AI deepfakes and automated phishing tools means that even employees who are security-aware can be deceived when the attack is sophisticated enough. ---

The Recovery: 98% Resolved, But At What Cost?

Binance's recovery of $6.17 billion represents a remarkable technical achievement, but the financial and reputational damage remains substantial. The exchange has implemented a multi-layered security overhaul that includes mandatory hardware security keys for all employees, AI-driven email filtering, and real-time transaction monitoring systems. However, the recovery process raises critical questions about the long-term viability of hot wallet architectures in the crypto industry. The $6.3 billion stolen was not a small-sum test — it represented roughly 13% of Binance's total on-chain assets at the time, a staggering concentration of value in a single attack surface. ---

What This Means for the Entire Crypto Industry

The $6.3 billion hack has sent shockwaves through the cryptocurrency sector, prompting exchanges, DeFi protocols, and wallet providers to reevaluate their security postures. Several industry-wide implications have already emerged: Mandatory cold storage ratios are becoming a regulatory expectation rather than a best practice Employee security training is being upgraded from annual workshops to continuous, AI-augmented simulation programs Cross-chain bridges and smart contract audits are receiving heightened scrutiny following the realization that the attack exploited internal systems, not just external interfaces ---

Frequently Asked Questions (FAQ)

Frequently Asked Questions (FAQ)

1. How did Binance recover 98% of the $6.3 billion stolen in the hack?

Binance worked with law enforcement agencies, traced the stolen funds through blockchain analytics firms, and negotiated recovery agreements with the hackers. The exchange also implemented enhanced security measures to prevent further unauthorized access. The recovery process involved freezing assets across multiple blockchain networks and working with jurisdictions where the hackers were located.

2. What specific AI tools did the hackers use in the attack?

According to Binance's security report, the attackers used an AI-powered tool to generate deepfake audio and video, craft convincing phishing emails at scale, and automate social engineering scripts. This AI capability allowed the hackers to personalize their attacks and bypass traditional email filtering systems that are designed to catch generic phishing attempts.

3. Is Binance still exposed to the remaining 2% of the stolen assets?

Binance has stated that the remaining 2% represents assets that are still frozen or under active investigation. The exchange continues to work with blockchain forensic firms to locate and recover these residual funds. While the immediate financial impact has been largely mitigated, the incident has prompted Binance to implement sweeping security reforms across its entire organizational structure.

--- *This article is for informational and analytical purposes only. It does not constitute financial advice. Readers should consult their own financial advisors before making investment decisions.*