Key points
- Binance details the fake job interview used in its hack
- Binance says hackers used its own AI tool to reach wallet engineers
- Why Binance's withdrawal freeze didn't stop the transfers
Binance says the hackers who stole about $6.34 billion in crypto from the exchange on October 29 spent months getting in. The attackers used a fake job interview to compromise an engineer, then used one of Binance's internal AI tools to reach its wallet engineers.
Binance laid out the attack in its first report on the incident, published November 3. "It was not a single isolated breach or a simple phishing incident," Binance said. The exchange called the report initial and said outside security firms will review its findings.
The FBI has blamed North Korea for the theft. On November 3, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, called the US accusation a "grave political provocation," Yonhap reported.
A tampered installer and a fake job interview opened the door
The first step came in June. An engineer on Binance's wallet DevOps team searched online for a popular AI coding tool and downloaded a tampered installation of Homebrew, a widely used tool for installing software on Macs, to set it up. Binance's security team spotted the problem, replaced the device, and rotated the engineer's credentials. But the hackers had already learned the engineer's role and who his colleagues on the wallet infrastructure team were, Binance said.
In September, a different Binance software engineer was contacted on a legitimate job-hunting platform by someone posing as a project director. His profile there mentioned his experience at Binance. A fake HR representative interviewed him by live video and shared a social media account with personal photos and videos to build trust. Binance said that approach was more advanced than social engineering it had seen before.
The second interview, with someone claiming to be the CEO of a company that doesn't exist, took place in a chat app. Near the end, the engineer was told to download an "assignment" onto his work computer. The code ran during setup and replaced a legitimate developer tool with a malicious copy that connected to a server the hackers controlled. Binance's endpoint security tools didn't detect it, and the hackers erased traces of the break-in, Binance said.
Binance says hackers used its own AI tool to reach the wallet team
On October 20, the hackers used the compromised computer and an internal Binance AI tool to gain control over two more engineers. One was the wallet DevOps engineer from June, and the other was a wallet software engineer. Binance didn't name the AI tool or say how the hackers used it.
On the DevOps engineer's computer, the hackers found a token that let him deploy containers, packaged software that runs on Binance's systems. In the hours before the theft on October 29, they logged onto the third engineer's computer, used the stolen token to deploy a container, and ran a malicious script that launched the attack.
An Ethereum feature kept the transfers going
The hackers used their access to an internal wallet signing service to send transactions outside Binance's normal withdrawal process. Between 4:05 p.m. and 4:09 p.m. ET, five Binance hot wallets sent 233.46 million XRP to an address the hackers controlled. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP. After an internal alert flagged the large transfers, a Binance hot wallet sent 18,270 bitcoin.
The hackers then used the signing service to exploit EIP-7702, an Ethereum feature that lets an account hand some execution rights to a smart contract without exposing its private key. Through 50 signing transactions, they gave a contract they controlled partial rights over a Binance hot wallet.
Suspending withdrawals didn't cancel those permissions, because they existed on the blockchain, outside Binance's withdrawal system. Binance's hot wallet used multi-party computation, which splits control of signing, so there was no single private key the team could use to revoke them right away. Binance said it had to build a special procedure, which took extra time.
The last unauthorized transfer, 2,961.9 ETH, finalized at 7:56 p.m. ET, nearly four hours after the first. Binance cleared the malicious delegation at 8:10 p.m. ET.
Binance has replaced 98% of the assets, not recovered them
About $2.85 billion of the $6.34 billion has been frozen or intercepted, Binance said, subject to reconciliation and price swings. On October 29, Binance had put the frozen amount at about $3 billion.
Binance said it had replenished 98% of the affected token assets as of October 31, using its own funds. That means Binance replaced the tokens, not that the stolen crypto came back. Binance said it's still buying the remaining, less liquid tokens.
Binance said it has closed the entry points the hackers used, rebuilt the affected wallet system and internal AI tool, replaced the affected devices, and retired the credentials involved. The exchange plans to spend more on AI-based threat detection and is working on a security research fund with AI companies and security firms. Binance said its security team has detected and stopped 57 suspected North Korea-linked attempts in 2026, including fake job interviews, malicious developer tools, and fake video-call apps.
North Korea denies the FBI's finding
The FBI said on October 31 that North Korea was responsible, linking the theft to a hacking group it calls TraderTraitor. Kim rejected that in a statement carried by North Korea's state news agency, KCNA. "It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds," she said.
Kim also pointed to the US decision last year to hold seized crypto in a strategic reserve. Anyone who looks at who ends up with "the so-called stolen cryptocurrency" once it's retrieved "may get a clue about who is behind the hacking incident," she said. She gave no evidence. Our earlier report covers the FBI's finding and Binance's first days of recovery.
