Binance is calling on AI security experts and technical professionals to help strengthen its security systems following a $6.3 billion security breach that exposed weaknesses in the exchange’s internal access controls.

In a statement on X, Binance co-founder Yi He said the exchange welcomes criticism of its security and access management, adding that the company has already begun restructuring its security systems to prevent similar incidents.

“Binance is not a perfect company, but a company that is constantly evolving,” she said, noting that the exchange reads user feedback and considers criticism an opportunity to improve.

Her comments follow Binance’s preliminary investigation report, which detailed how North Korean-linked attackers reportedly used malicious software, fake recruitment interviews and compromised employee devices to infiltrate the exchange’s internal systems. The FBI has attributed the theft to North Korea, identifying the operation as TraderTraitor.

Binance says it will cover all user losses

Yi addressed concerns about whether the breach would affect customers’ funds, saying Binance would take full responsibility for the financial impact.

“Binance will bear full responsibility, this is what we should do,” she said.

She argued that the company’s approach was based on putting users first, honouring its contractual obligations and accepting its moral responsibility rather than walking away when problems arise.

Binance has separately confirmed that it will cover the affected assets using its own resources. In its November 3 update, the exchange said it had set aside more than 100% of the funds needed to cover the loss and had replenished 98% of the affected token assets as of October 31.

The exchange estimated that approximately $6.34 billion in digital assets were affected. It also reported that about $2.85 billion had been frozen or intercepted, subject to reconciliation and market price movements.

The replenishment of affected customer balances should not be confused with recovering the original stolen cryptocurrency. Binance’s commitment means the exchange is covering the shortfall, while efforts to trace and recover the stolen assets continue.

Why Binance published its hacking report

Yi said some industry professionals had advised Binance against disclosing detailed information about the attack. The company chose to publish its preliminary findings because it believes transparency can help other organisations improve their security.

She specifically pointed to the complexity of social engineering and the need to establish clearer boundaries around AI tools and their permissions.

The investigation described how attackers allegedly used a fake recruitment process to persuade a Binance engineer to download and execute a malicious coding assignment. The malware compromised the employee’s computer and helped the attackers move deeper into the exchange’s internal systems.

Binance’s report also described earlier compromises involving developer tools and the use of internal AI infrastructure during the wider operation. The findings highlight how a seemingly routine work activity can become an entry point for attackers when device security, access controls and employee verification procedures fail.

Yi said the report would be useful if it helped other companies recognise similar risks and prevent comparable incidents.

Binance restructures security and access controls

Yi said Binance had begun changing its security architecture in response to the breach.

The measures include restructuring access management across departments, strengthening security boundaries between environments, replacing affected devices and resetting AI tools. She also cited the principles of zero trust and least privilege as guides for the changes.

Zero trust means systems should not automatically trust a user or device simply because it is already inside an organisation’s network. Access must be verified continuously and granted according to the specific task being performed.

Least privilege means employees and software should receive only the permissions they need to perform their duties, limiting the damage an attacker can cause if an account or device is compromised.

Binance’s November 3 investigation update also confirmed that affected systems had been rebuilt or replaced, compromised credentials and tokens had been revoked, and the exchange had strengthened wallet-service controls and AI-based behavioural monitoring. The company said it was engaging independent cybersecurity experts to review the incident and recommend additional safeguards.

Yi said an independent security audit would provide a further assessment of Binance’s systems.

Binance invites AI security experts to join

Yi ended her statement by inviting experienced AI security specialists and technical professionals to join Binance, saying they could contact her directly or apply through the company’s careers website.

She presented the invitation as an opportunity for specialists to help test and strengthen the exchange’s security systems.

The recruitment appeal comes as the incident raises wider questions about how cryptocurrency companies manage employee access, protect developer environments and secure AI tools that interact with internal systems.

For Binance, the next test will be whether its announced changes can withstand independent scrutiny and prevent similar attacks. Publishing the investigation is a step towards transparency, but the effectiveness of the new safeguards will ultimately depend on how they work in practice.

Read also: How a fake job interview helped hackers steal $6.3B from Binance