Binance said on Nov. 3 that the hackers who stole a record $6.3 billion got in through fake job interviews and a compromised internal artificial-intelligence tool. An engineer was approached on a real hiring site, then told in a second interview to download malware disguised as a work assignment. The company said that foothold was used in October to reach two other laptops and drain exchange wallets.
Customer withdrawals were frozen worldwide and restored on Sunday. Binance said it had reserved more than enough funds to cover the loss and that 98% of the affected token assets had been replenished as of Saturday. It also said FBI information points to North Korea. Hours later, North Korean official Kim Yo Jong denied any role and called the allegation an attempt to harm the country’s image.
The new detail for users is access, not a fresh theft total. A pledge to replace coins is not the same as every service having stayed open. This report does not show a loss on Binance.US or a restored balance for any named U.S. account.
Does Tuesday’s account show that a U.S. crypto balance was taken? No Binance.US loss was shown. The new facts are the fake-interview method, Binance’s claim that 98% of affected tokens were replenished by Saturday, and North Korea’s denial.