Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach

Binance said hackers used a fraudulent job interview to compromise an employee’s computer, then used an internal AI tool to access its wallet infrastructure and steal more than $6.3 billion in digital assets.

In an initial incident report published Tuesday, the world's largest crypto exchange detailed how attackers used malware and stolen credentials to access its wallet-signing systems. Binance said it has frozen or intercepted about $2.85 billion in assets and replenished 98% of impacted assets.

"This wasn't one mistake or one breach — it was a months-long campaign. We're publishing the full report because the lessons go far beyond Binance," co-CEO Richard Teng said on X. "The speed of coordination could not be matched in traditional finance."

Binance said the FBI had linked the attack to North Korea, while its own investigation found that hackers used social engineering, malware, and compromised internal AI tooling to gain access to its wallet-signing infrastructure and authorize unauthorized transactions.

According to the report, the attackers first targeted a Wallet DevOps engineer in June through a tampered Homebrew installation downloaded while he was trying to install an AI coding tool. Binance said its security team detected the anomaly, replaced the device, and rotated the affected credentials, but the incident exposed information about the engineer's role and colleagues. In September, attackers then targeted another employee through a fraudulent recruitment process, posing as company executives before tricking him into downloading a malicious coding assignment that infected his work computer and gave hackers unauthorized access.

On Oct. 20, the attackers used the compromised employee's computer and an internal AI tool to gain control of two other engineers' devices, discovering a container deployment permission on one of them. Nine days later, they used the stolen credentials to deploy a container and run a malicious script that launched the wallet attack.

Binance said it detected and prevented 57 suspected North Korea-linked cyberattacks throughout 2026, many involving similar tactics such as fraudulent interviews, malicious developer tools, and social engineering. On Monday, North Korean leader Kim Jong-un's sister called FBI claims linking North Korea to the hack a "grave political provocation."

Binance said it has since closed the entry points used in the attack, rebuilt or replaced affected systems, strengthened device controls, and expanded AI-based behavioral anomaly detection.

Separately, the exchange continued restoring normal operations, reopening withdrawals in phases for dozens of assets across BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, TRON and Base networks starting at 4 a.m. UTC on Nov. 3. Binance said it was prioritizing tokens based on user demand over the past week. The exchange later reported that hourly deposits exceeded withdrawals, describing the shift as a sign that flows were stabilizing and user activity was improving.