A fake job interview allowed hackers to infect the computer of an engineer at the Binance crypto platform, before the theft of $6.34 billion on October 29, 2026. In its report published on November 3, the exchange describes an infiltration carried out over several months, with trapped software, stolen identifiers and the misuse of an internal AI tool.
In brief
- An engineer downloaded an infected programming exercise after two fake interviews.
- The hackers then exploited an internal AI tool and deployment token.
- Binance says it has reconstituted 98% of affected assets and frozen or intercepted $2.85 billion.
A fake recruitment to trap a Binance engineer
The internal investigation describes much longer preparation than the Binance hack attributed to North Korean hackers suggested. According to the crypto exchange, the first signs date back to June 2026, four months before the flight.
An engineer responsible for crypto wallet operations downloaded a modified Homebrew installation while looking for an AI-assisted programming tool. Binance spotted the anomaly, replaced its computer and renewed its credentials. The hackers had nevertheless obtained information about his role and his colleagues.
In September, they targeted a second engineer, this time through a real recruitment platform. A fake project director offers him a job. A first video interview with a supposed human resources manager is followed by a second exchange with the supposed CEO of a fictitious company. Interlocutors use profiles and photos on social networks in particular to gain trust.
At the end, the candidate receives a technical exercise to download to their professional computer. The code repository contains malware that can launch while it is being configured. It replaces a legitimate development component and communicates with a server controlled by the attackers.
According to Binance, this threat unknown to its defenses at that time was not stopped by the post’s protection tools.
An AI tool hijacked to reach crypto wallets
On October 20, the attackers used the computer compromised during recruitment and an internal AI tool to reach two engineers from the crypto wallets team. They discover a token on one of the workstations authorizing the deployment of computer containers.
This detail matters more than the use of AI itself. The crypto platform does not say that an autonomous agent hacked the wallets: the tool served as a relay in an intrusion carried out by humans. The crypto sector is already monitoring other attacks in which AI-related techniques have been reported, although these incidents should not be confused.
On October 29, between 5:15 p.m. and 7:56 p.m. UTC, the hackers connected to the computer of a third engineer. Using the stolen permissions, they deploy a container. They then trigger a malicious script within the service responsible for signing crypto transactions.
Transfers begin at 8:05 p.m. UTC. In four minutes, five crypto wallets send 233.46 million XRP to an address controlled by the attacker. Other operations notably concern 970,500 SOL, 44.2 million OP and 18,270 BTC.
On Ethereum, hackers exploit the delegation permissions provided by EIP-7702. The objective? Execute operations on a malicious contract. Binance removes this delegation at 00:10 UTC on October 30. Unfortunately after finalizing a final ETH transfer at 11:56 p.m.
Binance replaces funds and reviews its security
In its first detailed assessment, Binance estimates the assets affected at $6.34 billion. The crypto company indicates that 2.85 billion have been frozen or intercepted, an amount still subject to change.
It also claims to have reconstituted 98% of the assets concerned as of October 31, thanks to its own resources. This does not mean that 98% of the loot was recovered from pirates. Binance assures that its customers will not bear the losses.
The company replaced compromised computers, revoked credentials, and rebuilt the signing environment. It also reinstalled its internal AI tool, strengthening access controls. An independent audit will complete these security measures.
Binance says it detected and prevented 57 cyberattack attempts suspected of being linked to North Korea in 2026. The FBI attributes the October 29 hack to the TraderTraitor group, an attribution disputed by Pyongyang.
The report explains how limited technical access ultimately paved the way for a multi-billion operation. Replenishing reserves does not solve everything. After withdrawals reopened, deposits returned to positive on Binance, but the crypto exchange has yet to demonstrate that its new protections can prevent similar infiltration.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
