Binance says fake job interviews and AI tool led to $6.3bn hack

Key points

• Binance says the campaign began in June with a tampered software package downloaded during AI coding tool setup.
• Attackers posing as recruiters in September tricked an engineer with a malicious coding assignment, then reached the wallet-signing service on 29 Oct.
• Binance says $2.85bn was frozen or intercepted and 98% of affected token assets replenished as of 31 Oct.

Binance has traced the $6.3bn hack of its wallet infrastructure to a months-long campaign that began with a fake job interview, according to a postmortem the exchange published on 3 November. The report says hackers combined compromised employee computers with stolen credentials to reach the systems that authorise transactions.

Binance detected the malware and replaced the device, but the attackers had already learned about its wallet team. In September, people posing as recruiters tricked another engineer into downloading a malicious file disguised as a coding assignment.

On 20 Oct the attackers used that computer and an internal AI tool to reach two more engineers' systems, obtaining deployment credentials. They installed malicious software in the wallet infrastructure on 29 Oct and accessed the wallet-signing service, moving funds outside the normal withdrawal process. Binance says they also exploited Ethereum's EIP-7702 mechanism to keep transfers going after withdrawals were suspended.

Binance says $2.85bn of the $6.3bn has been frozen or intercepted, and that it will absorb the losses rather than pass them to customers, having replenished 98% of affected token assets as of 31 Oct. Co-CEO Richard Teng called it a months-long campaign rather than a single breach. The FBI has attributed the theft, the largest crypto hack on record, to North Korean hackers; Kim Yo Jong denied involvement. Co-founder Yi He said the exchange blocked 57 suspected North Korea-linked threats in 2026.

Read the full story on Cointelegraph →