The Binance crypto heist that drained $6.3bn in digital assets on 29 October relied on fake job interviews, malicious code and a compromised internal AI tool, according to an incident report published by the cryptocurrency exchange on Tuesday, 3 November 2026.
Key points
- Attackers spent four months compromising Binance infrastructure before executing the record $6.3bn withdrawal on 29 October.
- A bogus job interview process and a malicious coding assignment duped an engineer into downloading malware that evaded detection.
- Hackers manipulated an internal AI tool to jump between developer accounts and take control of wallet authorisation systems.
- Binance said it has replenished 98% of the lost assets and is working with law enforcement to freeze stolen tokens.
How the multi-stage breach unfolded
Binance published its most detailed account yet of the breach, describing a coordinated social engineering and software intrusion that began in June. The company operates the largest cryptocurrency exchange in the world and previously froze user withdrawals as it assessed the damage.
Preparations began when an engineer on the Binance wallet developer team searched online for a popular artificial intelligence coding tool. The developer downloaded a tampered Homebrew package containing hidden malware. Binance security systems flagged the incident, replaced the infected device and rotated the employee credentials as a precaution.
The initial infection gave the attackers critical intelligence. While Binance contained the immediate device breach, the hackers mapped the structure of the wallet infrastructure team and identified other engineers with access to sensitive transaction authorisation pipelines.
Armed with that personnel data, the intruders launched a direct social engineering campaign against a second software engineer in September. The attackers approached the engineer through a legitimate job search platform, offering an interview for a fictitious position at an executive level.
Fake recruiters and weaponised coding tests
The attackers built credibility over several weeks. They created realistic social media profiles, complete with personal photographs, and arranged a virtual video meeting between the candidate and an actor posing as the chief executive of the fake firm.
During a second round of interviews, the recruiters instructed the engineer to complete a technical coding evaluation. The exercise required downloading a project repository onto the developer workstation. The repository contained obfuscated malware engineered specifically to bypass standard endpoint antivirus scanners.
The malicious software gave the hackers a persistent foothold on the engineer’s machine. Rather than launching an immediate attack against client funds, the intruders moved quietly through Binance systems to escalate their privileges across the corporate network.
The breach deepened on 20 October, when the hackers combined access from the infected laptop with an internal artificial intelligence tool. That compromise allowed the intruders to bridge corporate network boundaries and seize control of workstations belonging to two other wallet developers.
On 29 October, the attackers activated their exploit. Using stolen credentials from the first developer alongside the workstation of a second developer, they triggered a malicious automated script. The script breached the authorization controls governing the platform hot wallets, initiating unauthorised transactions totalling $6.34bn.
Internal AI tools under the microscope
The revelation that internal AI software served as an attack vector highlights emerging risks in automated enterprise workflows. Binance confirmed that attackers manipulated an internal tool to escalate administrative privileges and coordinate lateral movement between isolated engineering systems.
Binance co-chief executive Richard Teng addressed the findings during an appearance on CNBC, rejecting suggestions that the theft stemmed from a basic lapse on a single laptop. Teng said the hackers spent months establishing access before moving rapidly across administrative boundaries.
Teng said the attackers used their position to breach the systems responsible for authorising platform wallet transfers. “This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its published report.
The platform has faced intense operational pressure since the breach. Market observers previously watched closely as Binance crypto withdrawals resume in phases after $6.3bn hack, testing whether centralized infrastructure could withstand widespread customer redemptions.
Asset recovery and market response
Binance said on Tuesday that it has replenished 98% of the affected digital assets using corporate reserves. The company stated it has set aside more than 100% of the capital required to make affected users whole, though it continues to buy back illiquid tokens that were drained in the attack.
The exchange suspended global customer withdrawals immediately following the incident on 29 October. Trading resumed over the weekend, leading to substantial fund movements as Binance crypto withdrawals top $4.6bn after $6.3bn heist during the initial days of restored access.
Collaborative containment efforts by the wider digital asset industry helped blunt the total losses. Stablecoin issuers and exchange operators including Tether, Circle, Ripple and Coinbase moved to freeze roughly $3bn across known attacker addresses, though portions of the stolen tokens continue to pass through automated laundering mixers.
To repair its infrastructure, Binance rebuilt the compromised wallet environment and the associated internal AI systems from scratch. The company decommissioned all digital certificates, session tokens and credentials tied to the affected teams and deployed widened monitoring across all staff hardware.
The North Korea dispute
International investigators have linked the attack to state-backed hacking groups. The Federal Bureau of Investigation and the US Secret Service are assisting Binance with tracing on-chain transactions, attributing the intrusion to the North Korean cyber unit known as TraderTraitor or the Lazarus Group.
TraderTraitor previously carried out the $1.5bn breach of cryptocurrency exchange Bybit in 2025. United States authorities maintain that the Binance intrusion matches the specific recruitment-lure methodologies and custom malware loaders favoured by that state-sponsored outfit, leading analysts to label the incident the largest financial cyber robbery on record.
Binance formally acknowledged the FBI assessment on Tuesday, writing that law enforcement findings point to Democratic People’s Republic of Korea state operatives. That development follows earlier reporting where the Binance crypto heist of $6.3bn blamed on North Korean hacking squad drew condemnation from international security monitors.
Pyongyang rejected the allegations on Tuesday. Kim Yo Jong, a senior North Korean official and sister of leader Kim Jong Un, issued a statement calling the charges an effort by the United States to tarnish the country’s reputation. North Korea has routinely denied involvement in global cryptocurrency compromises.
What happens next
Binance announced it is hiring independent cybersecurity auditors to conduct an external examination of its software architecture, developer controls and internal operational practices. The exchange said it will also fund targeted security research alongside commercial artificial intelligence developers to identify zero-day vulnerabilities in machine learning infrastructure.
Investigators from international law enforcement agencies continue working with private blockchain analysis firms to track the remaining unrecovered assets as laundering networks attempt to convert the stolen tokens into fiat currency.
