Binance hack: fake job interview and in-house AI tool opened the door to $6.3B theft

What this is about

On November 3, 2026, Binance, the world's largest crypto exchange, published a first incident report on the October 29 theft. According to Binance, the damage is about $6.34 billion (other outlets cite $6.3 or $6.43 billion), making it the largest crypto theft in history. The report shows the attackers didn't simply grab a key. They prepared their access over months. Binance co-CEO Richard Teng told CNBC the perpetrators had "spent months building their way in." He rejected the idea that a single laptop was the weak point.

The four stages of the attack

June 2026: An engineer on the wallet DevOps team searched online for a popular AI coding tool and ended up installing a tampered version of Homebrew, a widely used package manager for macOS. According to Fortune, he clicked an ad rather than using the official route. Binance spotted the anomaly, replaced the device and renewed the credentials. But by then the attackers already knew who worked on the wallet team and what the engineer's role was. That knowledge couldn't be reset.

September 2026: A second software engineer was approached through a genuine job platform. His profile mentioned Binance. The sender posed as a project lead. A video call followed with a supposed recruiter, who showed a social media profile with private photos and videos to build trust. In the second interview, someone appeared as the CEO of a made-up company (according to The Hacker News, via a popular chat service). At the end, the engineer was asked to download a "task" onto his work computer. It contained a code repository whose malicious code ran during setup.

According to Binance, the malware was previously unknown (a "zero-day," meaning there was no detection for it yet) and slipped past endpoint protection tools. It swapped a legitimate component of a developer tool for a poisoned one, established contact with an attacker-controlled server and erased forensic traces.

October 20, 2026: Using the compromised machine and an internal Binance AI tool, the attackers took over the computers of two more engineers (wallet DevOps engineer A and software engineer C). On A's machine, they found a permission token that can launch containers (isolated software environments) in production.

October 29, 2026: Between 17:15 and 19:56 UTC, the attackers logged in to C's machine, used A's stolen credentials, started a container and ran a malicious script. According to Binance, this let them abuse an internal wallet signing service to trigger transactions outside the normal withdrawal process.

Why the drain kept going: EIP-7702 and MPC

Between 20:05 and 20:09 UTC, five hot wallets (wallets connected to the internet) transferred 233.46 million XRP to an attacker address, according to FinanceFeeds, along with about 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers then used EIP-7702, an Ethereum feature from the Pectra update that lets a regular account temporarily take on the logic of a smart contract. With 50 signing transactions, they set malicious authorizations that allowed an attacker-controlled contract to make further transfers.

Suspending withdrawals didn't stop this, because permissions already registered on-chain stayed in place. Binance secures hot wallets with MPC (multi-party computation): the private key never exists in one place, and multiple parties jointly produce every signature. That protects against the theft of a single key, but according to security chief Jimmy Su, no single key could revoke the authorization here. Binance had to develop its own revocation procedure. The last unauthorized transfer (2,961.9 ETH) was confirmed at 23:56 UTC, and the malicious delegation was removed on October 30 at 00:10 UTC.

The role of AI

Many had suspected the attackers used AI to break into Binance. According to Fortune, they relied mainly on classic phishing and social engineering instead. AI still played a part: Binance's own internal AI tool served as a bridge between the machines. Binance has rebuilt the tool.

Damage, reimbursement and countermeasures

Tether and Circle froze stolen stablecoins, and according to Fox Business, so did Ripple. Coinbase blocked transfers to affected wallets. Fortune says about $2.5 billion was recovered, while Binance itself says frozen, and FinanceFeeds points out that frozen isn't the same as recovered. The amounts are subject to reconciliation and price swings. The remaining 2% involves less liquid currencies that Binance is still sourcing. Fox Business gave a different figure of about 90%; that source is older or less precise.

Withdrawals were suspended for about 48 hours and have been reopening in phases since November 3 at 04:00 UTC, covering dozens of tokens across several networks. Binance lists these measures: entry points closed, affected systems rebuilt, devices replaced, credentials retired, security scans of all employee devices, stricter device controls, more AI-assisted anomaly detection, an independent expert audit and a security research fund.

Attribution and reactions

The FBI attributes the attack to the North Korean group TraderTraitor. Teng himself didn't name North Korea but confirmed the FBI's attribution. According to The Block, Kim Jong-un's sister called the allegations a "grave political provocation." Binance says it has already fended off 57 suspected North Korean attempts using similar methods in 2026, such as fake interviews, malware in developer tools, tampered packages and browser extensions, and fake video-conferencing apps. The approach matches an FBI warning from September 3, 2024. According to Fortune, Binance employees in non-public roles aren't allowed to keep LinkedIn profiles. A spokesperson wouldn't say whether the engineer broke that rule or whether he faces consequences.

What readers can take away

The pattern also affects developers and retail investors. The recommendations: verify recruiters through a contact channel you found yourself, open coding assignments only in a virtual machine, never store seed phrases on connected devices, install software only from the original source, and keep larger amounts on a hardware wallet.

Analysis

The report turns the record hack into a question of personnel security and the software supply chain. Good key management (MPC) wasn't enough, because the attackers stole permissions rather than keys. MPC even made containment harder. Caveats remain: the figures come from the company, the attribution is an assessment by US authorities, and no one has independently verified whether the rebuild is effective. According to CNBC, the market shock was sharp but brief. It's still unclear whether Binance will fully win back trust in centralized exchanges.