Binance details $6.34 billion crypto heist linked to fake job interviews and compromised AI tool
Binance revealed that a multi-month cyberattack culminating in a $6.34 billion theft on Oct. 29 breached its systems through a fake job recruitment scheme and an exploited internal AI tool.
Binance released initial investigative findings detailing how attackers executed a massive cryptocurrency theft on Oct. 29, 2026, draining approximately $6.34 billion across multiple networks. According to the exchange's report, the multi-stage campaign began in June 2026 when a wallet engineer downloaded a tampered Homebrew installer. In September, attackers posing as recruiters tricked a second engineer into executing a malicious coding assignment on a work computer, installing zero-day malware.[3][7][10]
On Oct. 20, the attackers used the compromised computer alongside an internal artificial intelligence tool to pivot across internal environments, gaining access to additional wallet engineers and locating container deployment credentials. By Oct. 29, the intruders used these permissions to launch a container and execute a malicious script inside Binance's wallet signing service. The attack drained 233.46 million XRP within four minutes, alongside roughly 970,500 SOL, 44.2 million OP, and 18,270 BTC. The attackers also exploited Ethereum's EIP-7702 delegation mechanism to maintain transfer authorizations on-chain even after Binance halted platform withdrawals.[4][5][7][10][13]
The FBI attributed the breach to North Korea-linked cyber actors known as TraderTraitor, though North Korea denied involvement. Binance co-CEO Richard Teng stated that approximately $2.85 billion in assets has been frozen or intercepted. Teng assured users that Binance will cover the full financial impact through company reserves and its SAFU emergency fund, noting that 98% of the affected tokens have already been replenished.[1][3][7][9][14][15]
Key facts
- Attackers stole an estimated $6.34 billion in digital assets from Binance hot wallets on Oct. 29, 2026.
- The intrusion started in June 2026 via a tampered software installer and escalated in September when an engineer ran malware disguised as a job interview coding assignment.
- Attackers leveraged an internal AI tool to pivot across developer environments, obtaining credentials to run scripts in Binance's wallet signing system.
- The theft included 233.46 million XRP, 18,270 BTC, roughly 970,500 SOL, and 44.2 million OP, alongside unauthorized Ethereum transfers using EIP-7702.
- Binance reports that approximately $2.85 billion in stolen funds has been frozen or intercepted.
- Binance co-CEO Richard Teng said Binance is absorbing the losses with internal and SAFU funds and has replenished 98% of the affected tokens.
- The FBI attributed the hack to North Korea's TraderTraitor group, while North Korea publicly denied involvement.
Sources · 14 sources
- BC
Bitcoin.com News@BitcoinNewsPost on X ·
BREAKING: 🎙💥 "This was a highly sophisticated, multi-month campaign, and FBI has attributed it to North Korea," says Binance co-CEO Richard Teng. 🗞️ "They used a combination of fake recruitment interviews, malicious software disguised as developer tools and AI techniques." https://t.co/7Q2nTXbMxl
Open source - TN
Tree News@TreeNewsFeedPost on X ·
BINANCE: ATTACKER LEVERAGED COMPROMISED COMPUTER AND USED INTERNAL AI TOOL TO GAIN CONTROL OVER WALLETS - RTRS
Open source - WS
Wall St Engine@wallstenginePost on X ·
BINANCE REVEALS HOW HACKERS STOLE $6.34B IN CRYPTO Binance says the October 29 hack was the result of a months-long operation involving fake job interviews, malicious developer tools and a compromised internal AI system. Here's how it unfolded: In June, a Binance wallet engineer downloaded a tampered software installer while trying to set up an AI coding tool. Binance detected the threat, replaced the device and reset credentials, but the attackers had already gathered Information about the wallet team. In September, another engineer was approached by a fake recruiter and went through two interviews for a nonexistent job. He was then asked to download a coding assignment that secretly installed malware on his work computer. By October 20, the attackers had used the compromised computer and Binance's internal AI tool to gain access to two more wallet engineers, eventually obtaining credentials that allowed them to deploy software. On October 29, they used those credentials to run malicious code inside Binance's wallet-signing system, triggering unauthorized crypto transfers. The attackers also exploited an Ethereum authorization feature that allowed some transfers to continue even after Binance suspended withdrawals. As for the stolen funds: Binance says approximately $2.85B has been frozen or intercepted. Separately, it has replenished 98% of the affected token assets using its own reserves. That means 98% has been replaced, not recovered. The FBI has attributed the attack to North Korea's TraderTraitor hacking group. However, North Korea denied involvement yesterday, with Kim Yo Jong, the sister of Kim Jong Un, calling the U.S. allegations "absurd rhetoric" and a "grave political provocation."
Open source - ST
Stalkchain@StalkHQPost on X ·
$6.34B left Binance in one night. Pausing withdrawals didn't stop it. 233M XRP in four minutes. 18,270 BTC. Then an EIP-7702 delegation that lived on-chain. About four hours from the first transfer to contained. https://t.co/OjstqrKGv9
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Binance Details $6.34B Hack: Fake Job Interviews Used to Plant Malware, Internal AI Tool Exploited Binance released an initial report on its October 29 hack, revealing that attackers used fake job interviews and malware to compromise an engineer's device in September. They later exploited an internal AI tool to gain access to wallet engineers, then used stolen credentials to compromise a wallet signing service and abuse Ethereum's EIP-7702 authorization mechanism. Binance said withdrawal suspensions alone could not stop the malicious on-chain authorizations, which required a separate revocation process. Of the $6.34 billion in affected assets, approximately $2.85 billion has been frozen or intercepted. Binance said 98% of affected token assets had been replenished as of October 31, with sufficient funds set aside to cover all losses. The investigation remains ongoing.
Open source - CR
CryptoSlateArticle ·
Binance relied on AI to fight fraud before hackers exploited internal tool in $6 billion theft Hackers exploited Binance's internal artificial intelligence tools to compromise engineers before stealing $6.34 billion in cryptocurrency, the exchange disclosed. In its Nov. 3 security report, Binance said attackers used a compromised employee computer and an internal AI tool on Oct. 20 to take control of two engineers responsible for its wallet infrastructure. The attackers subsequently… Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - UN
UnchainedArticle ·
Binance Details Four-Month Path From Tainted Developer Install to $6.34 Billion Drain Binance published its initial report on how attackers took about $6.34 billion in digital assets on Oct. 29, saying the intrusion began in June with a tampered software install and ran through a fake job interview in September. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . From Fake Recruiter to Stolen Token According to Binance, a wallet DevOps engineer downloaded a tampered Homebrew installation in June while searching for an AI coding tool. Binance spotted the compromise, gave him a new machine and reset his credentials, but the engineer and colleagues on the wallet infrastructure team had already been exposed to the attacker, Binance said. In September, a second engineer was approached on a job-hunting platform by someone posing as a project director, the exchange said. A live video interview with a purported HR representative came first. A second round, held in a social chat app with someone claiming to run a fictitious company, closed by telling him to fetch an “assignment” to his employer-issued computer. The repository behind it was malware. Binance said the zero-day malware went undetected by its endpoint tools at the time. On Oct. 20, Binance said, the attacker used that engineer’s computer and an internal AI tool to take control of the first engineer and a third, then found a container deployment token on the first engineer’s machine. On Oct. 29, the attacker used the stolen credentials to log onto the third engineer’s computer, deploy a container and run a malicious script. How the Money Moved Binance said five hot wallets moved 233.46 million XRP to an address held by the attacker between 20:05 and 20:09 UTC, and Solana and Optimism hot wallets lost roughly 970,500 SOL and 44.2 million OP. A hot wallet then sent 18,270 BTC. The attacker next used the internal signing service to exploit EIP-7702 , an Ethereum feature that lets a wallet hand some of its transaction powers to a contract, and gave a contract it controlled partial rights over a hot wallet, using 50 signing transactions. Because the wallet used multi-party computation, no single private key could revoke those delegations, Binance said, so the team built a specialized procedure that took additional time. The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC. Binance cleared the delegation at 00:10 UTC on Oct. 30. Cleanup and Coverage Binance said it rebuilt the affected wallet system and internal AI tool, replaced devices and decommissioned credentials tied to the engineers involved. It plans an independent third-party review and a security research fund, and said some technical details will stay confidential. The exchange said that 98% of impacted token assets had been replenished as of Oct. 31. Its own recovery updates gave lower figures: 90% on Oct. 31 and about 95% on Nov. 2. Related Listen: Why a Nation State Will Always Beat the Security of a DeFi Team The post Binance Details Four-Month Path From Tainted Developer Install to $6.34 Billion Drain appeared first on Unchained .
Open source - BS
BSCN@BSCNewsPost on X ·
Binance Reveals How Hackers Stole BTC, XRP And Other Assets Binance (@binance) says its investigation uncovered a multi-stage campaign behind the $6.3 billion Oct. 29 attack. The attackers used fake recruitment interviews and malicious software to compromise an engineer's work computer. They later exploited an internal AI tool to reach other employees and obtain access to wallet infrastructure. By October 29, the attackers had compromised credentials and deployed a malicious container. Five hot wallets transferred 233.46 million $XRP (@XRP) within four minutes. Solana (@solana) $SOL, Optimism (@Optimism) $OP, and Bitcoin $BTC wallets were also affected. Binance says approximately $2.85 billion in assets have since been frozen or intercepted. The exchange says it has rebuilt affected systems, replaced devices, revoked credentials, and strengthened security controls. It is also planning an independent cybersecurity review and expanded investment in AI security.
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨BINANCE CO-CEO: USERS WILL NOT BEAR ANY LOSSES FROM $6.3B HACK! @_RichardTeng told Fox Business that @binance is fully protecting users and has already restored 98% of the affected tokens, verifiable on its Proof of Reserves. “We now are operating, we are protecting every user, and we are extremely thankful for our users’ confidence and trust.” Binance is absorbing the financial impact itself. User funds remain safe.
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Binance Hack Timeline: How Attackers Compromised Three Engineers to Access Wallet Signing Service WuBlockchain mapped the attack timeline based on Binance’s preliminary investigation. In June, Wallet DevOps Engineer A downloaded a tampered Homebrew installer while setting up an AI coding tool. Although Binance detected the incident, replaced the device and rotated credentials, information about the engineer and colleagues was exposed. In September, Engineer B downloaded a malicious code repository during a fake job interview, compromising his work computer. On October 20, attackers used the compromised device and an internal AI tool to gain control over Engineers A and C, discovering a container deployment permission token on A’s computer. On October 29, they accessed C’s computer, used credentials stolen from A to deploy a container and execute a malicious script, and ultimately initiated unauthorized asset transfers through Binance’s internal wallet signing service.
Open source - LD
Lark Davis@LarkDavisPost on X ·
How hackers pulled off the $6.3B Binance heist, per Binance’s own report: June: A wallet dev downloads a tampered tool, promoted via a search ad above the real one. Binance catches it, but the wallet team stays exposed. September: A second engineer, job hunting, “interviews” with a fake company’s CEO and downloads a malicious code repo. Oct 20: Attackers use that machine plus an internal AI tool to take over two wallet devs’ systems. Oct 29: Using stolen credentials, they trigger the script. 233M XRP leaves five hot wallets in 4 minutes. Final transfer lands almost 4 hours later. FBI blames North Korea. Pyongyang denies it. Fake job interviews are an old trick. This one worked on the biggest exchange in crypto. Source: Reuters
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 UPDATE: Binance co-CEO Richard Teng says 98% of tokens impacted by the $6.34B hack have been replenished. https://t.co/SgjKvh6maP
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
🚨NEW: @Binance says attackers used fake job interviews, malware and a compromised internal AI tool to access its wallet signing service in the $6.34B hack. An engineer downloaded a malicious interview assignment onto a work computer. Attackers later used the internal AI tool to compromise two colleagues and steal deployment credentials. Ethereum EIP-7702 authorizations allowed further theft despite withdrawals being suspended, while Binance’s MPC setup complicated revoking access.
Open source - RE
Reuters@ReutersPost on X ·
Binance co-CEO Richard Teng says the exchange is in 'very strong financial health' after last week’s $6.3B cyber heist, with 95% of affected tokens replenished. Teng said the losses were covered by Binance’s SAFU emergency reserve and other company funds https://t.co/Tl7qwXmMFp https://t.co/u58m57pcbf
Open source - PR
ProtosArticle ·
Crypto survived cybersecurity awareness month… just Cybersecurity Awareness Month is thankfully over. An already bumper month, which saw a PHP vulnerability threaten an estimated 70% of websites and Ledger devices drained for $90 million via spyware implants, ended with a bang as Binance suffered the biggest hack (or theft of any kind) in history. The National Cybersecurity Alliance set this year’s theme as “Don’t Make It Easy for Them.” However, many have taken the stream of serious security breaches in the past month, both within crypto and elsewhere, as a sign of the dire state of cybersecurity in the age of AI-assisted hacking. I would like to congratulate the organizers of the 2026 Cybersecurity Awareness Month for putting together a truly spectacular event — lcamtuf (@lcamtuf) October 31, 2026 Read more: Linux earns ‘worst bug in the history of the internet’ status Multiple crypto hacks per day Blockchain security firm Peckshield tallied 56 “major hacks” across the crypto sector during Cybersecurity Awareness Month. #PeckShieldAlert In October 2026, the crypto industry experienced 56 major hacks, resulting in total losses of $6.48B, a ~745% month-over-month increase from September’s $766.49M. The #Binance incident (~$6.3B, with $3B already frozen) has jumped to #1 among the largest crypto… pic.twitter.com/Tlqh4yq9om — PeckShieldAlert (@PeckShieldAlert) November 1, 2026 Read more: LIVE: Binance resumes withdrawals leading to $6B outflows | Protos The vast majority of the month’s losses were from the monster $6.3 billion hack of Binance, of which around $3 billion was frozen on-chain. The FBI has officially attributed the attack to the North Korea-affiliated TraderTraitor, but the DPRK has denied any involvement. In its latest update , Binance detailed the “sophisticated, multi-stage campaign” which led to the attack, beginning in June when an employee downloaded a malicious version of the package manager Homebrew. Then, in September, another engineer was “instructed to download an ‘assignment’ containing a malicious code repository” during a staged job interview. The hackers were able to extend their reach during October before executing the attack on the 29th. The other large-scale loss this month saw Ledger users who bought spyware-implanted devices via reseller CryptoBilis, lose a combined $90 million worth of assets. Protos covered plenty of other incidents, including MetaMask unstaking $1.4B in ETH after a security scare, CoinDCX trying to sweep a $16 million hack under the rug, Keystone’s decision to destroy 19,000 units of inventory due to a compromised key, and data leaks which hit Coinbase and Bithumb users. Many other incidents resulted in smaller losses which, as one security researcher pointed out , “get no post mortem and no tweet from the team, the money is just gone.” As hacks piled up (the year has already seen double the number of crypto hacks in 2025), on October 8, Ethereum researcher Justin Drake urged the blockchain industry to go “bunker mode” in the face of AI threats. The advice wasn’t particularly well received, though, with Vitalik Buterin warning users not to “scramble” to move funds, but recognising that quantum-vulnerable and AI-vulnerable cryptography should be taken seriously. Read more: Initiate ‘bunker mode’ to protect crypto from AI, says Justin Drake Not just crypto Outside the crypto bubble, a PHP vulnerability threatened an estimated 70% of the web, with some governments shutting off their sites as a precaution. Spilling over into the real world, supermarket fridges in France were hacked and set to high temperatures causing spoilage estimated to be in the tens of millions of euros. So far, November is off to a flying start, too . And all signs point to security incidents increasing in frequency going forward. A bug in Linux has been dubbed “worst bug in the history of the internet,” someone is hacking supermarket fridges again, this time across Europe and, on the crypto front, Brazilian exchange Mercado Bitcoin lost almost $50 million yesterday. To top it off, blockchain sleuth ZachXBT has traced around $130 million of stolen funds from what he believes to be a “large financial institution in Western Europe” but, as yet, nobody has admitted to being the victim. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post Crypto survived cybersecurity awareness month… just appeared first on Protos .
Open source