Binance reveals how its $6.3bn hack unfolded: a fake coding tool, a fake job interview and its own AI system
Binance has published its first account of the record $6.34bn theft from 29 October, describing a months-long campaign that began with a fake developer tool in June, a staged job interview in September, and the misuse of its own internal AI tools to reach its wallets.
Binance, the world’s largest cryptocurrency exchange, has set out for the first time how hackers stole about $6.34bn from its wallets on 29 October, in what is the largest crypto theft ever recorded. In an initial incident report published on 3 November, the exchange described not a single breach but a careful, multi-stage campaign that unfolded over months, using fake software, fake recruitment and, finally, Binance’s own internal artificial intelligence tools against it.
The campaign began in June, Binance said, when an engineer searched online for an AI coding tool and installed a counterfeit version planted by the attackers. That fake installer gave the intruders their first foothold inside the company. A second engineer was then targeted in September through a legitimate job platform, where a profile mentioning Binance drew the attention of people posing as a project director and recruiters for a company that did not exist.
The second engineer went through a staged hiring process, including a video interview with a supposed human resources representative and a later round with a man claiming to run the fictitious firm. Near the end of that process, the engineer was asked to download a coding assignment onto a work computer. That file carried hidden malware designed to evade endpoint detection, and it compromised the machine.
Binance co-chief executive Richard Teng described the operation on CNBC on Tuesday, saying the attackers had spent months building their way in. He rejected the idea that the theft came down to one employee’s laptop, saying the campaign was far more elaborate than a simple phishing incident and that the lessons extended well beyond Binance itself.
By 20 October, according to the report, the attackers had used a compromised device and internal AI tooling to reach two further engineers’ devices and locate a deployment token. On 29 October, between 17:15 and 19:56, they logged on to a third engineer’s computer, used stolen credentials, deployed a container and ran a script that reached Binance’s internal wallet signing service, allowing the funds to be moved.
The exchange said about $2.85bn had been frozen or intercepted as of 3 November, and that 98 per cent of the affected token assets had been replenished from its own funds by 31 October, with the remainder still being bought. It said no customer would bear the loss, and withdrawals, which resumed on 1 November, had broadly continued, although customers had still withdrawn a net $4.72bn by 11:28 UTC on 3 November, according to CoinDesk figures.
Attribution remains contested. Binance’s report cites the FBI’s finding that North Korea’s TraderTraitor group was responsible, and the FBI has said the group stole more than $6bn from Binance on or about 29 October. North Korea has denied any role, a denial carried by its state media, while analysts at Elliptic have said on-chain evidence supports the FBI’s attribution, even as others caution that wallet analysis alone cannot prove state sponsorship.
The episode has already rattled the wider crypto market. Bitcoin, which had been trading near $77,500 before the US midterm elections, dipped below $76,000 in the days after the theft was disclosed, with more than $1bn pulled from US-listed spot Bitcoin exchange-traded funds across two sessions around the election, before staging a partial recovery above $78,000 as election uncertainty faded.
For the industry, Binance’s account is a warning about a new kind of attack surface. The intruders did not break a vault door; they walked in through the everyday tools of modern software work — a downloaded developer utility, a job application and an internal AI assistant — and then moved patiently from one machine to the next until they reached the system that authorises wallet transactions.
What happens next will be watched on two fronts. Investigators and exchanges will be tracing the frozen funds and testing whether the remaining assets can be recovered, while regulators and companies will be asking whether internal AI tools, recruitment processes and software downloads need the same level of protection as the wallets themselves. Binance has promised a fuller report, and the industry will be reading it closely.
Figures in this post, including the $6.34bn theft, the $2.85bn frozen or intercepted and the 98 per cent replenishment figure, were checked at 2026-11-04T14:51:31+05:00 against Binance’s initial incident report and the CNBC and CoinDesk coverage of it.
This post is market news information only, not financial advice.
More in Crypto & Markets
Photo: A person holding a Bitcoin coin (file image)
Crypto & MarketsBinance customers pull $4.72 billion after record hack as FBI blames North Korean hackers
Binance customers withdrew a net $4.72 billion after the exchange reopened following last week’s $6 billion hack, the largest in crypto history, as US investigators blamed North Korea’s TraderTraitor group for the theft.
Photo: A Bitcoin coin (file image)
Crypto & MarketsBitcoin rebounds above $78,000 after midterm dip as DeFi tokens lead the recovery
Bitcoin recovered from below $76,000 to trade above $78,000 on 4 November 2026 after US midterm results eased uncertainty, with DeFi tokens leading gains and ether up about 2 per cent.
Photo: A physical Bitcoin token (file image)
Crypto & MarketsBitcoin stages V-shaped recovery after dipping below $76,000 as midterm uncertainty fades
Bitcoin has erased its election-night losses in a sharp V-shaped recovery, rebounding from below $76,000 towards $78,000 as clearer United States midterm results eased political uncertainty, even as heavy ETF outflows continue to weigh on the market.