North Korean hackers used an elaborate scheme to pull off their $6.3 billion hack of Binance last week, the crypto exchange said — approaching one of its engineers as a fake company and conducting a series of phony job interviews before hacking into his computer.

Initial findings from investigation of what experts have called the largest bank heist in history revealed that the record-breaking cyberattack was a much more complex process than previously known – starting back in June and involving ads for tampered software, stolen credentials and fake interviews.

In June, hackers laid the groundwork for their attack when an employee at Binance, referred to as “Engineer A,” downloaded tampered software found online that had been disguised and advertised as a popular AI coding tool. 

Binance said its security team detected the malware and immediately replaced the device and all employee credentials – but the attackers had already learned of Engineer A and his related colleagues’ roles at the firm.

In September, “Engineer B” was contacted through a legitimate job-search platform – where he had a profile including his experience at Binance – by a person posing as a project director at a company. 

He completed a first-round interview with someone posing as an HR representative, who shared photos and videos from a social media account to make themselves appear legitimate, the company said. 

Toward the end of a second-round interview with a person pretending to be the CEO of a fake company, Engineer B was instructed to download an “assignment” onto his work computer that actually contained malicious code – setting off a chain of unauthorized activities. 

On Oct. 20, the attacker used the compromised computer and an internal AI tool to gain control over Engineer A and another Engineer C and discovered that Engineer A had a deployment permission token – a specialized credential – on his computer.

The hackers then used the credentials stolen from Engineer A to launch the massive attack on Oct. 29, draining billions of dollars from crypto wallets within 20 minutes and quickly spreading the riches across global networks. 

On Saturday, the FBI linked the notorious North Korean state-backed cybercrime group TraderTraitor to the heist. TraderTraitor is known for quickly laundering stolen booty across vast crypto networks, making it virtually impossible to recover.

North Korea has denied any ties to the attack, calling the accusation a “grave political provocation,” according to state-backed media.

This is a developing story. Please check back for updates.