LONDON, ENGLAND - OCTOBER 30: In this photo illustration, the Binance logo is displayed on a phone screen adjacent to an image from a crypto exchange on a laptop on October 30, 2026 in London, England. The world's largest cryptocy exchange, Binance, experienced a $6.3 billion security exploit yesterday, representing the largest digital asset theft to date. The incident occurred when an unauthorised attacker drained funds from the exchange's hot wallets across 10 distinct blockchain networks within a 20-minute window. In response, Binance temporarily suspended all deposits and withdrawals, and co-founder Yi He confirmed that the exchange will fully cover all user losses using company assets. (Photo by Dan Kitwood/Getty Images) Suspected North Korean hackers hit Binance for $6.3b. Photo / Getty Images
Binance has released its first detailed investigation into the massive $6.34 billion cryptocy hack on October 29, revealing that attackers used fake job interviews, malicious software and a compromised internal artificial intelligence tool to infiltrate the exchange’s wallet infrastructure. The sophisticated cyberattack, which the FBI attributed to North Korea’s TraderTraitor hacking group, unfolded over several months and involved compromising multiple Binance engineers before gaining access to critical wallet-signing systems. The world’s largest cryptocy exchange confirmed that approximately $2.85 billion in stolen assets has been frozen or intercepted, while 98% of affected assets have been replenished using company funds. The incident represents one of the largest cryptocy security breaches in history and raises serious concerns about the growing use of social engineering and AI-related vulnerabilities in cyberattacks.
On November 3, Binance published its initial incident report detailing how hackers systematically infiltrated the exchange’s internal infrastructure before executing the multibillion-dollar theft.
According to Binance co-CEO Richard Teng, the attack was not the result of a single security failure but a coordinated operation that developed over several months.
The attackers combined sophisticated social engineering techniques with malicious software and stolen employee credentials to gain access to systems responsible for managing the exchange’s cryptocy wallets.
The investigation identified several stages of the attack:
June 2026: Hackers targeted a Binance Wallet DevOps engineer through a compromised software installation associated with an AI coding tool.
September 2026: A second employee was deceived through a fraudulent job recruitment process and downloaded a malicious coding assignment.
October 20: Attackers used a compromised computer and an internal AI tool to access additional engineering devices and identify deployment permissions.
October 29: Stolen credentials were used to deploy malicious software that initiated unauthorized cryptocy transfers from Binance wallets.
The timeline demonstrates how attackers maintained a long-term strategy, exploiting different vulnerabilities until they obtained sufficient access to execute the theft.
One of the most significant findings involved a fraudulent recruitment campaign targeting a Binance software engineer in September.
According to the investigation, an attacker contacted the employee through a legitimate employment platform while impersonating a project director at a fictitious technology company.
The employee participated in what appeared to be a legitimate hiring process, including video interviews with individuals posing as company representatives.
To establish credibility, the attackers used social media profiles containing personal photographs and videos, making the recruitment opportunity appear authentic.
During a subsequent interview, the employee was instructed to download and complete a coding assignment as part of the hiring process.
However, the assignment contained malicious software designed to bypass security detection systems.
Once the employee downloaded the compromised files onto a work computer, the attackers gained unauthorized access to the device and began expanding their control over Binance’s internal infrastructure.
The incident highlights the increasing sophistication of employment-related cyberattacks, particularly those targeting software engineers and cryptocy professionals with access to sensitive systems.
The investigation also revealed that attackers exploited an internal artificial intelligence tool as part of their effort to compromise Binance’s wallet infrastructure.
The initial infiltration began months earlier, in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation package while attempting to install an AI-powered coding tool.
Binance’s security team detected the suspicious activity, replaced the affected device and rotated the compromised credentials.
However, the attackers had already gathered valuable information about the engineer’s responsibilities and professional connections within Binance’s wallet development team.
After compromising another employee through the September recruitment scam, the attackers used the infected computer and an internal AI tool on October 20 to gain control of two additional engineers’ devices.
This provided access to a container deployment permission, which allowed the attackers to execute software within Binance’s internal infrastructure.
On October 29, the hackers used stolen credentials to deploy a malicious container and run a script targeting the exchange’s wallet-signing systems.
The attack illustrates how internal AI tools can become part of a broader security breach when attackers gain access to employee devices and associated permissions.
Importantly, Binance’s findings do not suggest that artificial intelligence independently initiated the theft. Instead, the attackers exploited compromised systems and an internal AI tool to expand their access.
The attack ultimately resulted in approximately $6.34 billion in unauthorized cryptocy transfers, making it one of the largest digital asset thefts ever reported.
Unlike conventional cryptocy thefts involving a single compromised private key, this operation targeted the infrastructure responsible for authorizing transactions.
The attackers reportedly exploited Ethereum’s EIP-7702 functionality to establish malicious execution permissions over a Binance hot wallet.
Because Binance uses multiparty computation technology for portions of its wallet infrastructure, revoking the unauthorized permissions required a coordinated response.
According to Binance’s security briefing, the unauthorized transfers began at approximately 20:05 UTC on October 29, with containment continuing into the early hours of October 30.
The attackers initially transferred approximately 233.46 million XRP from five internet-connected wallets within four minutes before targeting additional cryptocurrencies.
Binance’s security teams began freezing assets and implementing emergency containment measures, but the complexity of the compromised permissions delayed the complete shutdown of unauthorized activity.
The incident exposed vulnerabilities not only in employee security but also in the operational systems connecting software deployment permissions to cryptocy wallet authorization.
The Federal Bureau of Investigation (FBI) has attributed the Binance breach to TraderTraitor, a North Korean state-sponsored hacking operation associated with cryptocy theft and financial cybercrime.
North Korean hacking organizations have repeatedly targeted cryptocy exchanges, blockchain companies and digital asset investors through sophisticated phishing campaigns and malicious software.
The Binance incident follows a broader pattern in which attackers impersonate recruiters, technology executives and legitimate business contacts to gain access to cryptocy infrastructure.
However, North Korea has denied responsibility for the attack.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, publicly rejected the FBI’s allegations, describing the accusations as politically motivated.
Despite the denial, U.S. authorities continue to identify North Korean cyber operations as a major threat to the global cryptocy industry.
Binance also revealed that its security teams had detected and prevented 57 suspected North Korea-linked cyberattack attempts during 2026, including operations involving fraudulent recruitment campaigns, malicious development tools and social engineering.
Following the attack, Binance initiated emergency recovery procedures to secure customer assets and restore normal exchange operations.
The company reported several major developments in its response:
$2.85 billion in stolen cryptocy was frozen or intercepted.
98% of affected assets had been replenished using Binance’s own financial resources.
Compromised employee devices and affected internal systems were replaced or rebuilt.
Additional security controls were introduced to prevent similar attacks.
Binance has stated that customers will not bear losses resulting from the breach.
The exchange also began gradually restoring cryptocy withdrawals across multiple blockchain networks, including Ethereum, BNB Smart Chain, Solana, XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base.
Withdrawals resumed in phases beginning November 3, with Binance prioritizing assets based on customer demand.
The company subsequently reported that hourly deposits had begun exceeding withdrawals, suggesting that customer activity was stabilizing following the incident.
However, the recovery process and broader investigation remain ongoing.
In response to the breach, Binance announced additional cybersecurity measures designed to prevent future attacks against its internal infrastructure.
The exchange has closed the entry points identified during its investigation and strengthened employee device security, credential management and internal access controls.
Binance is also expanding its use of AI-powered behavioral anomaly detection to identify suspicious activity before attackers can exploit compromised accounts or systems.
Additionally, the company plans to commission an independent cybersecurity review to assess its security architecture and identify weaknesses that may have contributed to the attack.
The findings could influence how cryptocy exchanges protect wallet-signing infrastructure, monitor internal AI tools and verify employee access to sensitive systems.
The $6.34 billion Binance hack demonstrates how cryptocy security threats are evolving beyond traditional phishing emails and stolen private keys.
Attackers increasingly combine human deception, compromised software dependencies, employee impersonation and internal technology vulnerabilities to penetrate sophisticated financial platforms.
The involvement of an internal AI tool is particularly significant as more cryptocy companies integrate artificial intelligence into development, infrastructure management and operational workflows.
Although AI can improve productivity and security monitoring, compromised access to these systems can also create additional opportunities for attackers.
For cryptocy exchanges and blockchain developers, the incident underscores the importance of securing employee devices, verifying recruitment-related software downloads and limiting access to critical wallet infrastructure.
The attack also reinforces the growing national security concerns surrounding state-sponsored cryptocy theft, particularly as digital assets become more deeply integrated into global financial markets.
As Binance continues its investigation and recovery efforts, the breach could become a defining case study for cybersecurity standards across the cryptocy industry, demonstrating that even the largest exchanges remain vulnerable when sophisticated attackers successfully exploit the intersection of human behavior, artificial intelligence and blockchain infrastructure.
Apple, Home Depot, Boeing and ServiceNow have joined a growing group of major U.S. corporations…
House Democrats are reportedly preparing a new cryptocy market structure bill following their victories in…
Brazilian cryptocy exchange Mercado Bitcoin is facing increased scrutiny after blockchain investigators discovered that hackers…
Solana Labs has officially launched Leap, a new mobile trading application that allows users to…
Morgan Stanley has become one of the first major U.S. banks to tokenize traditional financial…
The Office of the Comptroller of the Currency (OCC) has introduced its first supervisory framework…