Binance hack post-mortem: a fake job interview and an internal AI tool opened the door to $6.34 billion
Binance's first incident report traces the largest crypto theft on record to a months-long campaign against three wallet engineers. About $2.85 billion has been frozen or intercepted.
TL;DR
- Binance published its initial incident report on Nov. 3, 2026, tracing the $6.34 billion theft to a multi-stage campaign that compromised three engineers' computers, SecurityWeek reported.
- In September, a wallet engineer was lured through two rounds of fake job interviews and told to download a coding assignment that contained malware; Binance said the 0-day malware was not detected by its endpoint tools at the time.
- On Oct. 20 the attackers used the infected machine and an internal AI tool to take control of two more engineers' systems, then launched the wallet attack on Oct. 29.
- Binance said about $2.85 billion has been frozen or intercepted and 98% of impacted tokens have been replenished; the FBI has attributed the theft to North Korea's TraderTraitor group.
The largest crypto theft on record did not start with a smart contract bug. According to Binance's first incident report, published on Nov. 3, 2026, it started with a search ad, a fake recruiter and a coding assignment. The attackers took $6.34 billion in digital assets; about $2.85 billion has been frozen or intercepted, SecurityWeek reported.
"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said, according to SecurityWeek. The FBI has blamed the theft on TraderTraitor, a North Korean state-sponsored hacking group.
How the attack unfolded
The campaign began in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while looking for a popular AI coding tool through a search engine. Binance caught it, replaced the device and reset credentials, but the attackers had already learned what he did and who he worked with, SecurityWeek reported. The Verge said the installer was apparently spread by a malicious Google ad.
In September, a second engineer was approached by a fake "project director" and invited to two interviews: one with a fake HR representative, one with the supposed CEO of a company that did not exist. The second interview ended with a request to download a coding "assignment" onto his work computer. It hid malware that swapped in a rogue copy of a legitimate developer tool component. "The 0-day malware was not detected by the endpoint security protection tools at the time," Binance said.
On Oct. 20, the attackers used the infected machine and an internal AI tool to gain control of the first engineer's system and a third wallet engineer's system. The report does not explain how the AI tool was used, SecurityWeek noted. On Oct. 29, they signed into the third engineer's computer, deployed a container with credentials taken from the first engineer and started the attack with a malicious script.
Why withdrawals could not stop it
The attackers reached an internal wallet signing service and used it to move XRP, SOL, OP and BTC out of hot wallets. They also abused Ethereum's EIP-7702 mechanism to give a contract they controlled partial execution rights over a hot wallet. "Suspending withdrawals alone could not stop all unauthorized asset movements," Binance said. Because the hot wallet used multi-party computation (MPC), "there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations," according to the report quoted by The Verge.
Recovery so far
Co-CEO Richard Teng said 98% of impacted tokens have been replenished and withdrawals have broadly resumed, according to The Verge and The Block. Binance said it has rebuilt the affected wallet system and AI tool, retired the engineers' credentials and tokens, is engaging independent security firms and has blocked 57 suspected North Korea-linked threats this year. Elliptic said the stolen funds passed through about 12,000 wallets on 11 blockchains in under four days, and roughly $3.18 billion remained in theft-linked addresses as of Nov. 3, SecurityWeek reported. North Korea has rejected the FBI's attribution.
What it means for Web3 teams – Analysis
The weak point was not cryptography but people and internal tooling. Any team whose engineers can touch signing infrastructure should treat recruiting outreach, take-home coding tests and internal AI assistants as part of its attack surface. Separate machines for privileged work, strict limits on what internal AI tools can reach, and a tested plan to revoke on-chain delegations are now basic hygiene, not extras. This is not investment advice.
FAQ
How did the Binance hackers get in?
According to Binance's Nov. 3, 2026 report, through a tampered Homebrew download in June and a fake job interview in September whose coding assignment contained malware.
What role did AI play?
On Oct. 20 the attackers used an infected machine and an internal Binance AI tool to gain control of two more engineers' systems. Binance has not explained how the tool was used.
Why could Binance not stop the transfers by pausing withdrawals?
Malicious EIP-7702 authorizations existed on-chain, and because the hot wallet used MPC there was no single private key to revoke them immediately.
How much has been recovered?
About $2.85 billion has been frozen or intercepted, and Binance says 98% of impacted tokens have been replenished.
Sources
News summary based on the sources above. Not investment, legal or tax advice. Editorial policy & corrections · Report an error
Building in Web3? Turn the news into trust.
Positioning, KOL programs, LinkedIn systems and claim-safe content for Web3 and fintech teams.
Related
Samsung Wallet puts USDC on Solana in front of ~82 million U.S. Galaxy devices
Stablecoin Account is live: buy, hold, send USDC in the wallet app, with Bastion custody and Coinbase as sub-custodian — no separate crypto app.
Anchorage Digital applies to become a CFTC swap dealer for bitcoin and ether options
The first federally chartered crypto bank wants to put its institutional options desk under the Dodd-Frank dealer regime. Corporate bitcoin and ether treasuries are driving the demand, the firm says.
Zcash NU7 is about to freeze about $16 million left in its oldest privacy pool
Holders have until roughly Thursday evening ET to move Sprout coins before version-4 transactions are rejected. NU7 also cuts target block time from 75 seconds to 25.