Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto

Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto

The $6.3 Billion Heist: How a Sophisticated Phishing Campaign Targeted Binance

The bottom line first: A staggering $6.34 billion was stolen from Binance through a meticulously orchestrated social engineering attack that exploited fake job interviews and an AI-powered deepfake tool, according to the exchange's own security report released Tuesday. The exchange has since replenished 98% of the affected assets, but the incident exposes critical vulnerabilities in how modern crypto platforms verify institutional access and employee identities. ---

How Hackers Executed the $6.3 Billion Heist

Binance co-CEO Richard Teng confirmed that the attackers used a dual-pronged approach combining fake job interview scams with an AI deepfake tool to gain unauthorized access to the exchange's cold storage wallets. The scheme unfolded over an extended period, allowing the threat actors to gradually siphon assets without triggering immediate red flags. The attack vector worked as follows: 1. Fake Job Interview Setup — The hackers posed as recruiters or hiring managers from legitimate-looking crypto firms, reaching out to Binance employees under the guise of offering employment. 2. AI-Powered Identity Spoofing — During these fabricated video calls, the attackers used AI-generated voice and video deepfakes to impersonate Binance executives, bypassing basic identity verification protocols. 3. Gradual Asset Exfiltration — Once inside the internal systems, the hackers moved assets from cold storage wallets to personal wallets over weeks, exploiting the lack of real-time transaction monitoring on certain wallet addresses. ---

The Recovery: 98% of Stolen Assets Restored

According to the security report published by Binance, the exchange has successfully replenished 98% of the $6.34 billion in affected assets. This near-complete recovery rate is remarkable but raises important questions about the remaining 2% and the systemic risks that remain. | Metric | Value | |---|---| | Total assets stolen | $6.34 billion | | Assets recovered | $6.21 billion (98%) | | Assets still missing | ~$126 million (2%) | | Attack method | Fake job interviews + AI deepfake | | Timeframe of theft | Weeks to months | | Exchange response | Internal investigation + external security audit | ---

Why AI Deepfakes Pose an Existential Threat to Crypto Platforms

The incident underscores a rapidly growing vulnerability: AI-generated synthetic media can now convincingly impersonate human voices and faces at scale. For financial institutions handling billions in digital assets, this represents a fundamental challenge to identity verification frameworks that were designed for an analog world. Key implications include: Video verification is no longer sufficient — Traditional liveness detection tools can be fooled by high-quality deepfake technology. Social engineering is becoming more personalized — Attackers can now research targets on LinkedIn, craft tailored fake interview scenarios, and generate realistic impersonations in real time. Cold storage remains the primary attack surface — Moving assets to air-gapped cold wallets creates a window where transactions are invisible to real-time monitoring systems. ---

What Binance and the Industry Must Do Next

Richard Teng and the Binance security team have outlined several remediation steps: Upgrading identity verification protocols to include biometric liveness checks resistant to deepfake manipulation. Implementing real-time transaction monitoring across all wallet addresses, including cold storage. Enhancing employee security awareness training with specific modules on AI-powered social engineering. Partnering with third-party cybersecurity firms for continuous penetration testing and threat modeling. The broader crypto industry now faces a wake-up call. As digital asset platforms continue to attract institutional capital, the sophistication of attacks will only increase. Regulators are also expected to introduce stricter identity verification requirements for crypto exchanges, particularly those handling large-value transactions. ---

Frequently Asked Questions (FAQ)

Q1: How did hackers actually steal $6.3 billion from Binance? A: The attackers used a combination of fake job interview scams and AI deepfake technology to impersonate Binance employees during video calls, eventually gaining internal access to move funds from cold storage wallets to personal wallets over an extended period. Q2: Has Binance fully recovered the stolen funds? A: No, Binance has recovered 98% of the $6.34 billion, leaving approximately $126 million still missing. The remaining funds may be in self-custody wallets outside Binance's control. Q3: What can other crypto exchanges learn from this incident? A: Other exchanges must upgrade identity verification to resist AI deepfakes, implement real-time monitoring of all wallet addresses including cold storage, and invest heavily in employee training to recognize sophisticated social engineering tactics.