Binance Says a Fake Job Interview and an Internal AI Tool Opened the Door to Its $6.3 Billion Hack

Binance has finally explained how the largest crypto theft on record actually happened. In an initial incident report published on Tuesday, Nov. 3, the exchange said attackers spent months working their way inside, starting with a poisoned software installer and a fake job interview.

The final step, according to Binance, involved abusing one of its own internal AI tools to take over engineers' machines and reach the system that signs wallet transactions. About $6.34 billion in digital assets was affected.

"This wasn't one mistake or one breach — it was a months-long campaign," co-CEO Richard Teng said on X, as quoted by The Block. "We're publishing the full report because the lessons go far beyond Binance."

What Binance says happened

The exchange described the attack as a "sophisticated, multi-stage campaign." According to The Hacker News, the report said it "was not a single isolated breach or a simple phishing incident."

Instead, Binance said, the attackers combined fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and "an advanced transaction-authorisation method."

June: a poisoned installer

The first foothold came in June 2026. A Wallet DevOps engineer, called "Engineer A" in the report, searched for a popular AI coding tool and downloaded a trojanized Homebrew installer, The Hacker News reported.

The Verge said the tampered installer was apparently spread through a malicious Google ad. Binance said its security team spotted the anomaly, replaced the device and rotated the related credentials.

That should have been the end of it. But Binance admitted that information about Engineer A's role and his colleagues on the wallet infrastructure team had already been exposed to the hacker.

September: the fake job interview

In September, the attackers approached a second engineer, "Engineer B," through a legitimate job-hunting platform. They posed as a Project Director at a company that did not exist.

According to The Hacker News, the first-round video interview was with a supposed HR representative, who shared a social media account full of personal photos and videos to build trust. A second round, with someone claiming to be the fake company's CEO, took place on a popular chat app.

"Near the end of the interview, Engineer B was instructed to download an 'assignment' containing a malicious code repository onto his work computer," Binance said in the report.

The code ran during setup. The Verge reported that the malware replaced the pyenv executable with a malicious version that gave the attackers backdoor access, and Binance said its endpoint tools did not catch it at the time.

October: the internal AI tool and the heist

On Oct. 20, the attackers used Engineer B's compromised computer and abused an internal AI tool to gain control of the machines of Engineer A and a third person, Software Engineer C, according to the report.

On Engineer A's computer they found a container deployment permission token. "On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack," Binance wrote.

That gave the attackers access to an internal wallet signing service, letting them push transactions outside the normal withdrawal process. Security Today reported that they also exploited Ethereum's EIP-7702 authorization mechanism to keep moving assets after withdrawals were suspended.

Where the money stands

Binance said about $2.85 billion has been frozen or intercepted, and that it has replenished 98% of the affected assets, The Block reported. The exchange has said it will absorb the loss rather than pass it on to users.

The FBI has already pinned the attack on North Korea's TraderTraitor unit, which we covered when withdrawals first reopened. Kim Yo Jong, the sister of Kim Jong Un, has denied any role, calling the allegation a "grave political provocation," according to The Block and Decrypt.

Binance also said it detected and blocked 57 suspected North Korea-linked cyberattacks during 2026, many using the same playbook of fraudulent interviews and malicious developer tools.

Why it matters

The method is not new, and that is the uncomfortable part. Chainalysis wrote that North Korean actors have repeatedly used what its Senior Manager of Global Services Alec Zebrick calls "contagious interviews" to target employees with privileged access.

What is new is the scale, and the role of AI tooling on both ends. The first infection came from someone trying to install an AI coding assistant, and the lateral move came through an AI tool Binance itself had built for staff.

For every exchange, custodian and DeFi team, that turns developer laptops and internal AI agents into part of the attack surface for hot wallets. The pressure is already visible: Brazil's Mercado Bitcoin was hit by a $40 million breach days later, and CoinDesk reported a wave of other attacks across the industry.

Market reaction and what's next

Investors are still nervous. CoinDesk reported that U.S. spot bitcoin ETFs lost $399 million on Monday, with BlackRock's IBIT shedding $405 million, and that Binance customers had pulled a net $4.72 billion since withdrawals reopened, up from the $3.64 billion we reported on Sunday.

Quartz, citing Bloomberg, put bitcoin ETF outflows at $1.04 billion across Friday and Monday. Bitcoin was trading around $76,900 on Tuesday morning, according to CoinDesk.

There are early signs of calm. The Block reported that Binance reopened withdrawals for dozens of assets across networks including BSC, Ethereum, Solana, XRP, TRON and Base from 4 a.m. UTC on Nov. 3, and later said hourly deposits exceeded withdrawals.

Binance says it has closed the entry points, rebuilt or replaced affected systems, tightened device controls and expanded AI-based anomaly detection. It is also commissioning an independent cybersecurity review, which will be the next document to watch.