Binance has released its first detailed investigation into the massive $6.34 billion cryptocurrency hack on October 29, revealing that attackers used fake job interviews, malicious software and a compromised internal artificial intelligence tool to infiltrate the exchange’s wallet infrastructure. The sophisticated cyberattack, which the FBI attributed to North Korea’s TraderTraitor hacking group, unfolded over several months and involved compromising multiple Binance engineers before gaining access to critical wallet-signing systems. The world’s largest cryptocurrency exchange confirmed that approximately $2.85 billion in stolen assets has been frozen or intercepted, while 98% of affected assets have been replenished using company funds. The incident represents one of the largest cryptocurrency security breaches in history and raises serious concerns about the growing use of social engineering and AI-related vulnerabilities in cyberattacks.
Binance Investigation Reveals Months-Long Cyberattack
On November 3, Binance published its initial incident report detailing how hackers systematically infiltrated the exchange’s internal infrastructure before executing the multibillion-dollar theft.
According to Binance co-CEO Richard Teng, the attack was not the result of a single security failure but a coordinated operation that developed over several months.
The attackers combined sophisticated social engineering techniques with malicious software and stolen employee credentials to gain access to systems responsible for managing the exchange’s cryptocurrency wallets.
The investigation identified several stages of the attack:
June 2026: Hackers targeted a Binance Wallet DevOps engineer through a compromised software installation associated with an AI coding tool.
September 2026: A second employee was deceived through a fraudulent job recruitment process and downloaded a malicious coding assignment.
October 20: Attackers used a compromised computer and an internal AI tool to access additional engineering devices and identify deployment permissions.
October 29: Stolen credentials were used to deploy malicious software that initiated unauthorized cryptocurrency transfers from Binance wallets.
The timeline demonstrates how attackers maintained a long-term strategy, exploiting different vulnerabilities until they obtained sufficient access to execute the theft.
Fake Job Interviews Used to Infect Binance Employee Computers
One of the most significant findings involved a fraudulent recruitment campaign targeting a Binance software engineer in September.
According to the investigation, an attacker contacted the employee through a legitimate employment platform while impersonating a project director at a fictitious technology company.
The employee participated in what appeared to be a legitimate hiring process, including video interviews with individuals posing as company representatives.
To establish credibility, the attackers used social media profiles containing personal photographs and videos, making the recruitment opportunity appear authentic.
During a subsequent interview, the employee was instructed to download and complete a coding assignment as part of the hiring process.
However, the assignment contained malicious software designed to bypass security detection systems.
Once the employee downloaded the compromised files onto a work computer, the attackers gained unauthorized access to the device and began expanding their control over Binance’s internal infrastructure.
The incident highlights the increasing sophistication of employment-related cyberattacks, particularly those targeting software engineers and cryptocurrency professionals with access to sensitive systems.
Hackers Exploited Internal AI Tool to Access Crypto Wallet Infrastructure
The investigation also revealed that attackers exploited an internal artificial intelligence tool as part of their effort to compromise Binance’s wallet infrastructure.
The initial infiltration began months earlier, in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation package while attempting to install an AI-powered coding tool.
Binance’s security team detected the suspicious activity, replaced the affected device and rotated the compromised credentials.
However, the attackers had already gathered valuable information about the engineer’s responsibilities and professional connections within Binance’s wallet development team.
After compromising another employee through the September recruitment scam, the attackers used the infected computer and an internal AI tool on October 20 to gain control of two additional engineers’ devices.
This provided access to a container deployment permission, which allowed the attackers to execute software within Binance’s internal infrastructure.
On October 29, the hackers used stolen credentials to deploy a malicious container and run a script targeting the exchange’s wallet-signing systems.
The attack illustrates how internal AI tools can become part of a broader security breach when attackers gain access to employee devices and associated permissions.
Importantly, Binance’s findings do not suggest that artificial intelligence independently initiated the theft. Instead, the attackers exploited compromised systems and an internal AI tool to expand their access.
Hackers Steal $6.34 Billion Through Compromised Wallet Systems
The attack ultimately resulted in approximately $6.34 billion in unauthorized cryptocurrency transfers, making it one of the largest digital asset thefts ever reported.
Unlike conventional cryptocurrency thefts involving a single compromised private key, this operation targeted the infrastructure responsible for authorizing transactions.
The attackers reportedly exploited Ethereum’s EIP-7702 functionality to establish malicious execution permissions over a Binance hot wallet.
Because Binance uses multiparty computation technology for portions of its wallet infrastructure, revoking the unauthorized permissions required a coordinated response.
According to Binance’s security briefing, the unauthorized transfers began at approximately 20:05 UTC on October 29, with containment continuing into the early hours of October 30.
The attackers initially transferred approximately 233.46 million XRP from five internet-connected wallets within four minutes before targeting additional cryptocurrencies.
Binance’s security teams began freezing assets and implementing emergency containment measures, but the complexity of the compromised permissions delayed the complete shutdown of unauthorized activity.
The incident exposed vulnerabilities not only in employee security but also in the operational systems connecting software deployment permissions to cryptocurrency wallet authorization.
FBI Links Attack to North Korea’s TraderTraitor Group
The Federal Bureau of Investigation (FBI) has attributed the Binance breach to TraderTraitor, a North Korean state-sponsored hacking operation associated with cryptocurrency theft and financial cybercrime.
North Korean hacking organizations have repeatedly targeted cryptocurrency exchanges, blockchain companies and digital asset investors through sophisticated phishing campaigns and malicious software.
The Binance incident follows a broader pattern in which attackers impersonate recruiters, technology executives and legitimate business contacts to gain access to cryptocurrency infrastructure.
However, North Korea has denied responsibility for the attack.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, publicly rejected the FBI’s allegations, describing the accusations as politically motivated.
Despite the denial, U.S. authorities continue to identify North Korean cyber operations as a major threat to the global cryptocurrency industry.
Binance also revealed that its security teams had detected and prevented 57 suspected North Korea-linked cyberattack attempts during 2026, including operations involving fraudulent recruitment campaigns, malicious development tools and social engineering.
Binance Freezes $2.85 Billion and Replenishes 98% of Affected Assets
Following the attack, Binance initiated emergency recovery procedures to secure customer assets and restore normal exchange operations.
The company reported several major developments in its response:
$2.85 billion in stolen cryptocurrency was frozen or intercepted.
98% of affected assets had been replenished using Binance’s own financial resources.
Compromised employee devices and affected internal systems were replaced or rebuilt.
Additional security controls were introduced to prevent similar attacks.
Binance has stated that customers will not bear losses resulting from the breach.
The exchange also began gradually restoring cryptocurrency withdrawals across multiple blockchain networks, including Ethereum, BNB Smart Chain, Solana, XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base.
Withdrawals resumed in phases beginning November 3, with Binance prioritizing assets based on customer demand.
The company subsequently reported that hourly deposits had begun exceeding withdrawals, suggesting that customer activity was stabilizing following the incident.
However, the recovery process and broader investigation remain ongoing.
Binance Strengthens Cybersecurity and Launches Independent Review
In response to the breach, Binance announced additional cybersecurity measures designed to prevent future attacks against its internal infrastructure.
The exchange has closed the entry points identified during its investigation and strengthened employee device security, credential management and internal access controls.
Binance is also expanding its use of AI-powered behavioral anomaly detection to identify suspicious activity before attackers can exploit compromised accounts or systems.
Additionally, the company plans to commission an independent cybersecurity review to assess its security architecture and identify weaknesses that may have contributed to the attack.
The findings could influence how cryptocurrency exchanges protect wallet-signing infrastructure, monitor internal AI tools and verify employee access to sensitive systems.
Binance Hack Raises New Questions About AI and Crypto Security
The $6.34 billion Binance hack demonstrates how cryptocurrency security threats are evolving beyond traditional phishing emails and stolen private keys.
Attackers increasingly combine human deception, compromised software dependencies, employee impersonation and internal technology vulnerabilities to penetrate sophisticated financial platforms.
The involvement of an internal AI tool is particularly significant as more cryptocurrency companies integrate artificial intelligence into development, infrastructure management and operational workflows.
Although AI can improve productivity and security monitoring, compromised access to these systems can also create additional opportunities for attackers.
For cryptocurrency exchanges and blockchain developers, the incident underscores the importance of securing employee devices, verifying recruitment-related software downloads and limiting access to critical wallet infrastructure.
The attack also reinforces the growing national security concerns surrounding state-sponsored cryptocurrency theft, particularly as digital assets become more deeply integrated into global financial markets.
As Binance continues its investigation and recovery efforts, the breach could become a defining case study for cybersecurity standards across the cryptocurrency industry, demonstrating that even the largest exchanges remain vulnerable when sophisticated attackers successfully exploit the intersection of human behavior, artificial intelligence and blockchain infrastructure.
