Binance said on Tuesday that the record-setting theft of $6.34 billion in digital assets from the world's largest cryptocurrency exchange was the result of a campaign that combined fake job interviews, a tampered developer tool and abuse of an internal AI system. The Binance hack, carried out on October 29, was traced in an initial incident report published November 3 through the compromised devices of three engineers.

The disclosure matters because it shows how a fraudulent recruitment process became the entry point to critical financial infrastructure, according to Security Affairs. The attackers combined social engineering, stolen credentials and compromised tooling to reach the exchange's wallet signing systems, and Binance described the operation as a sophisticated, multi-stage campaign rather than a single breach.

"The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method," the company said.

How the Binance hack began in June

The campaign began in June 2026, when an engineer on Binance's Wallet DevOps team searched online for a popular AI coding tool and downloaded a trojanized Homebrew installer, according to the company's report. Binance said it detected the suspicious activity, replaced the device and rotated the associated credentials, but not before information about the engineer's role and his colleagues on the wallet infrastructure team was exposed to the attacker.

The attacker later discovered that the engineer's computer held a container deployment permission token, Binance said. That early foothold gave the threat actor a map of the wallet team even after the initial compromise was contained.

Binance co-CEO Richard Teng told CNBC's Squawk on the Street on Tuesday that the attackers "spent months building their way in," rejecting suggestions that the theft stemmed from a single point of failure on one employee's laptop. "In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that," he said.

Fake job interviews delivered the malware

The second stage unfolded in September 2026, when the threat actor contacted another engineer through a legitimate job-hunting platform while posing as a Project Director, according to The Hacker News. The persona arranged a first-round interview with someone posing as a human resources representative, followed by a second-round interview with an individual claiming to be the CEO of a non-existent company. Binance did not disclose details of the fake company.

During the first-round video interview, the fake HR representative shared a social media account with personal photos and videos to build credibility and trust. The second round moved to a popular social chat app, where, Binance said, "Near the end of the interview, Engineer B was instructed to download an 'assignment' containing a malicious code repository onto his work computer."

The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities, the company said. According to Binance, the malware replaced a legitimate development tool component with a malicious version, allowing the attackers to run commands and communicate with an attacker-controlled external server. Hackread reported that the replaced file was a pyenv component in the macOS Homebrew installation directory.

Binance said its endpoint security tools did not detect the previously unknown malware at the time, and CyberSecurityNews reported that the zero-day malware wiped its own traces. The employee's profile had referenced his experience at Binance, making him a valuable target, according to BleepingComputer.

AI tool abuse and the wallet signing breach

On October 20, the attackers used the compromised computer to abuse an internal AI tool and gain access to the systems of two other employees, including the Wallet DevOps engineer first targeted in June. Binance has not explained how the AI tool enabled that access, according to Hackread.

On October 29, the attackers accessed a third engineer's computer and used credentials stolen from the first engineer to deploy a container and launch a malicious script. That gave them access to Binance's internal wallet signing service, allowing them to initiate transactions outside the normal withdrawal process.

The attackers used the compromised signing service to initiate unauthorized transfers across multiple blockchains, including 18,270 BTC, approximately 970,500 SOL, 233.46 million XRP and 44.2 million OP. Between 20:05 and 20:09 UTC, five Binance hot wallets transferred the 233.46 million XRP, according to CyberSecurityNews and Hackread.

The attackers also exploited Ethereum's EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a Binance hot wallet without exposing its private key. Binance said the attackers submitted 50 signing transactions to manipulate the account's transaction sequence and establish those permissions, according to Bitcoin.com News.

Suspending withdrawals was not enough to stop the transfers, because the malicious authorizations already existed on-chain and operated independently of Binance's normal withdrawal infrastructure. The company said its multi-party computation wallet setup meant there was no single private key available to revoke them immediately, and it had to develop a specific procedure to revoke them. At 00:10 UTC on October 30, Binance cleared the delegation by authorizing the zero address.

Recovery, freezes and replenishment

Binance estimates that approximately $6.34 billion in assets were affected, of which around $2.85 billion had been frozen or intercepted as of its November 3 update, with the figure subject to reconciliation and market price changes. The exchange said it will absorb the financial impact and had replenished 98% of the affected token assets based on figures reported on October 31.

Teng told CNBC that Binance is still in the process of purchasing outstanding, more illiquid assets. Binance and industry partners including Tether, Circle and Ripple have frozen about $3 billion in assets, though some stolen funds continue to move through laundered channels, CNBC reported, and Coinbase blocked transfers to compromised wallets and offered Binance direct assistance.

In response to the incident, Binance reconstructed the affected wallet system in a new environment, rebuilt the internal AI tool and access controls, replaced compromised devices and decommissioned credentials and tokens associated with the affected engineers, Teng said. The company is also engaging independent cybersecurity firms to review the incident, and said its investigation remains ongoing, with some technical findings to undergo independent verification before it releases additional information.

"We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said.

North Korea link and industry pattern

The FBI attributed the incident to the North Korea-linked group it tracks as TraderTraitor, also known as Lazarus Group and APT38, according to Security Affairs. North Korea has rejected allegations that it orchestrated the theft, Bitcoin.com News reported.

Binance said that since the start of the year it has detected and prevented 57 suspected North Korea-linked cyber threat cases. "The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware," the company said.

Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job, according to BleepingComputer, though Binance has not linked the compromise to either specific campaign. "We've identified dozens of other job interview compromises that have led to wallet compromises," Tom McLouth, a senior intelligence analyst at Chainalysis, said.

Cybercrime author Geoff White noted on LinkedIn that recruitment lures have featured in earlier attacks, including the 2022 theft of $625 million from Axie Infinity, which happened via a job offer to an employee. Gina Cardelli, Director of Platform and Threat Intelligence at Fortra, questioned how the compromised employee device enabled access to sensitive systems, Hackread reported.

Conclusion

Binance's November 3 report establishes that the October 29 theft of about $6.34 billion was a months-long operation that moved from a trojanized Homebrew download in June, through fake job interviews in September, to abuse of an internal AI tool and the exchange's wallet signing service in late October. About $2.85 billion had been frozen or intercepted as of the report date, and Binance said it had replenished 98% of affected token assets as of October 31.

The next concrete step is the independent review: Binance said it is engaging outside cybersecurity firms and that some technical findings will be verified before it releases additional information, while the investigation continues.

Frequently Asked Questions

How much was stolen in the Binance hack on October 29, 2026?

Binance estimates that approximately $6.34 billion in digital assets were affected, making it a record crypto theft. As of the company's November 3 update, around $2.85 billion had been frozen or intercepted, with the figure subject to reconciliation and market price changes.

How did fake job interviews lead to the Binance hack?

In September 2026, attackers posing as a Project Director contacted a Binance engineer through a legitimate job-hunting platform and ran two bogus interviews. Near the end of the second interview, the engineer was told to download an "assignment" containing a malicious code repository onto his work computer, which installed malware that evaded Binance's endpoint security tools.

Who did the FBI say carried out the Binance theft?

The FBI attributed the incident to the North Korea-linked group it tracks as TraderTraitor, also known as Lazarus Group and APT38, according to Security Affairs. North Korea has rejected the allegations, Bitcoin.com News reported.

Will Binance cover customer losses from the $6.34 billion theft?

Binance said it will absorb the financial impact rather than pass losses to customers. The exchange said it had replenished 98% of affected token assets as of October 31, and co-CEO Richard Teng told CNBC it is still purchasing outstanding, more illiquid assets.

What role did Ethereum's EIP-7702 play in the Binance hack?

The attackers exploited Ethereum's EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a Binance hot wallet without exposing its private key. Because the authorizations existed on-chain, suspending withdrawals did not stop the transfers, and Binance had to develop a specific procedure to revoke them, clearing the delegation at 00:10 UTC on October 30.