Binance says fake job interviews and an abused AI tool enabled a $6.34bn theft

What Binance says happened

Binance published its incident report on 3 November. Its account starts in June 2026, when a Wallet DevOps engineer it calls Engineer A downloaded a tampered Homebrew installation for a popular AI coding tool after finding it through a search engine. Binance said it detected the anomaly, replaced the device and rotated credentials. It also said information about Engineer A's role and colleagues on the wallet infrastructure team was exposed to the attacker.

In September 2026, someone posing as a Project Director at a fictitious company contacted a second engineer, Engineer B, on a legitimate job-hunting platform. Two interviews followed. The first was a live video call with a supposed HR representative, who shared a personal social media account to build trust. The second ran through a chat app with someone claiming to be the company's CEO. Near the end, the person told Engineer B to download an assignment from a code repository.

The repository carried malware that executed during setup. Binance called it custom and undetected by endpoint tools at the time. It replaced a legitimate development tool component with a malicious version. It also removed traces as it ran.

"It was not a single isolated breach or a simple phishing incident," the company said in the report.

On 20 October, the attackers used Engineer B's compromised computer and an internal AI tool to gain control of the computers of Engineer A and another wallet engineer, Engineer C, The Hacker News reported. On 29 October, between 17:15 and 19:56, the attacker logged into Engineer C's computer, used credentials stolen from Engineer A, deployed a container and triggered a malicious script. Wired reported that the hackers moved billions in about 20 minutes.

Why the signing service mattered

The script reached an internal wallet signing service, the system that authorises transactions. That let the attackers initiate transfers outside the normal withdrawal process. Richard Teng, Binance's co-CEO, rejected the idea that one employee's laptop was a single point of failure. Teng told CNBC the attackers "spent months building their way in".

BleepingComputer reported a second mechanism. The attackers abused Ethereum's EIP-7702 authorisation feature. That let them keep moving funds after Binance suspended withdrawals. Binance has acknowledged that authorised transactions continued after the freeze.

Binance said it found no evidence of a wallet private key leak. It said it would cover losses from its Secure Asset Fund for Users and its own funds.

Attackers took funds across 11 blockchains, and 82% of them sat on Ethereum and Bitcoin, according to The Hacker News. Of the $6.34 billion affected, $2.85 billion had been frozen or intercepted, about 45%. Tether, Circle, Ripple, Arbitrum and Optimism froze that $2.85 billion, The Hacker News reported. Tether and Circle alone froze more than 1.567 billion USDT and 800 million USDC, and Arbitrum's Security Council about $30.5 million.

The cleanup and the money

Binance had replenished 98% of the $6.34 billion in affected assets as of 31 October, BleepingComputer reported. Teng told CNBC on 3 November that Binance was still buying the outstanding, more illiquid ones.

By 3 November the exchange had rebuilt the affected wallet system and internal AI tools. It had replaced devices and decommissioned compromised credentials. It had also finished enhanced scans of employee machines. Withdrawals returned in stages. Binance said it began restoring withdrawals in phases at 6 a.m. UTC on 1 November, The Hacker News reported. Teng told CNBC that an independent expert would review "everything that we have done".

North Korea and the totals

The FBI attributed the theft to TraderTraitor, a North Korea-aligned group, on 31 October. Binance stops short of naming TraderTraitor itself, pointing to the FBI's attribution. It says its security team detected and prevented 57 suspected North Korea-linked cases in 2026. Elliptic said the single incident almost doubles the total cryptoassets stolen by North Korea, which it put at over $6.5 billion in recent years. That is consistent with the figures: a $6.34 billion haul is close to the prior total, so the cumulative figure would be roughly double.

The haul eclipses the Bybit theft in February 2025, which The Hacker News put at $1.46 billion. Wired said TraderTraitor previously stole more than $1.5 billion in a separate hack last year.

Binance and CNBC put the loss at $6.34 billion, the figure this article uses. The Hacker News put the haul at $6.43 billion. Chainalysis estimated about $5.912 billion at the time of theft, calling it nearly four times the next largest heist.

What happens next

Binance says it is working around the clock with law enforcement and industry partners to trace and freeze the remaining funds. The FBI said it expected the attackers to convert the stolen assets mainly into Ethereum. It said they would then launder them through DeFi and instant swap services.

Withdrawals will return progressively as checks finish.