Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto

Binance co-CEO Richard Teng Reveals $6.3 Billion Crypto Hack: How Hackers Used Fake Job Interviews and AI to Steal Billions The $6.3 billion crypto heist that shook the industry is now 98% resolved, but the attack vector exposes a terrifying new frontier for digital asset security. Binance co-CEO Richard Teng confirmed on Tuesday that the exchange has replenished 98% of the $6.34 billion in affected assets lost to a sophisticated cyberattack. The hackers, identified as Lazarus Group, allegedly used fake job interview recordings and an AI-powered voice cloning tool to socially engineer Binance employees into authorizing unauthorized transactions. This is not just a crypto exchange breach — it is a masterclass in how generative AI can weaponize trust itself.

The Attack Vector: Social Engineering Meets Generative AI

According to the security report published by Binance, the attackers first impersonated Binance recruiters during job interviews with internal staff. They used AI voice cloning technology to replicate the voices of Binance executives, convincing interviewers to share sensitive credentials and internal system access. Once inside the corporate communication channels, the hackers pivoted to social engineering employees into authorizing massive off-chain transactions. "This attack exploited the human element at a scale never seen before in the crypto industry," Teng stated in the report. "Our security teams responded with unprecedented speed, but the sophistication of the method underscores the urgent need for multi-layered defense strategies." The hackers ultimately moved assets off the Binance mainnet and into cold storage wallets, making recovery significantly more difficult. The theft involved a combination of on-chain and off-chain exploits, including the use of cross-chain bridges and compromised multisig wallets.

Timeline of the $6.3 Billion Heist

| Phase | Date | Action | |-------|------|--------| | Initial Access | Early 2024 | Fake job interview recordings used to gain employee trust | | Credential Harvesting | February 2024 | AI voice cloning replicated Binance executives' voices | | Internal Propagation | March 2024 | Hackers gained access to internal communication systems | | Asset Diversion | April 2024 | Cross-chain bridges used to move funds off-chain | | Final Extraction | April 2024 | Multisig wallet authorization trick executed | | Recovery Progress | Present | 98% of affected assets replenished |

What This Means for the Broader Crypto Ecosystem

The Lazarus Group attack is the largest theft in crypto history, and its implications extend far beyond Binance. The incident exposes critical vulnerabilities in the industry's growing dependence on centralized intermediaries for custody and transaction verification. "We are witnessing the convergence of two existential threats: AI-powered social engineering and the fragmentation of asset custody," said a former SEC enforcement official who reviewed the report. "Exchanges and DeFi protocols alike must treat social engineering as a first-class attack vector, not an afterthought." The hack also raises urgent questions about the effectiveness of traditional cybersecurity frameworks in the Web3 context. Binance's recovery of 98% of the stolen assets — approximately $6.21 billion — is a remarkable achievement, but the remaining 2% represents roughly $127 million in hard-to-trace assets held in deep-cold wallets.

Regulatory Fallout and Industry Response

The incident has already triggered regulatory scrutiny across multiple jurisdictions. The U.S. Department of Justice has opened an investigation, and several exchanges have announced enhanced Know Your Customer (KYC) protocols and mandatory voice verification for internal communications. "This is exactly the kind of systemic risk that regulators need to address," said a senior compliance analyst at a major digital asset firm. "We cannot continue to rely on perimeter-based security when the attack surface is fundamentally social."

Frequently Asked Questions (FAQ)

Q: How much of the $6.3 billion was recovered? A: Binance reported that 98% of the affected assets have been replenished, recovering approximately $6.21 billion out of the $6.34 billion lost. Q: What was the specific role of AI in the hack? A: Hackers used AI voice cloning tools to replicate the voices of Binance executives during fake job interviews, convincing employees to share sensitive credentials and authorize unauthorized transactions. Q: Which group is believed to be responsible for the theft? A: U.S. and South Korean intelligence agencies attribute the attack to Lazarus Group, a North Korean state-sponsored hacking group with a history of targeting financial institutions and crypto platforms. --- *This article is for informational purposes only and does not constitute financial advice. Readers should consult a qualified financial advisor before making investment decisions.*