Binance said on Tuesday that attackers who stole about $6.3 billion from the cryptocurrency exchange used fake job interviews, malware posed as a hiring assignment, and a compromised internal AI tool, according to BBC and The National^1,2.

Binance described the theft in initial findings as a multi-stage campaign that compromised engineers' computers and then used those footholds to drain wallets^1,2.

BBC reported Binance's account that one engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with people posing as company representatives¹. Binance said the attackers used more advanced methods to build trust, including social media accounts that contained personal images¹.

During a second interview, the engineer was instructed to download malware masquerading as an assignment; Binance said the code used obfuscation that evaded detection¹. Attackers then used the compromised computer and a compromised internal AI tool in October to gain control of two other engineers' machines, BBC reported¹.

The National, citing a Binance post on Tuesday, said the compromised laptop and AI tool were used as a springboard on Oct. 20². Binance listed combined techniques including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorization method².

The National said Binance had rebuilt systems and decommissioned credentials of tokens related to the affected engineers². BBC reported Binance called the episode a serious security incident, said it should not have happened, and apologized to users and partners¹.

Binance said it was working with law enforcement to trace and freeze affected assets and had set aside more than 100% of the funds needed to cover the loss, with 98% of impacted token assets replenished as of Saturday, BBC reported¹. BBC said withdrawals were suspended globally and restored on Sunday¹.

U.S. agencies including the FBI and Secret Service have been assisting in tracing funds, and those agencies plus some cyber analysts have said the attack showed signs of North Korean involvement, BBC reported¹. Kim Yo Jong of North Korea denied the accusation on Tuesday, calling it an attempt by the United States to damage the country's image, according to BBC¹. Attribution remains disputed; The National's account of Tuesday's Binance findings did not address who was responsible^1,2.