Binance says hackers used fake job interviews and AI tools to steal $6.3 billion in record crypto heist

A fake job interview, a malicious coding assignment, and a compromised internal AI tool helped hackers steal $6.34 billion from Binance in what could be the largest financial heist in history. The world’s largest cryptocurrency exchange revealed Tuesday that attackers spent months infiltrating its systems before draining billions of dollars from its wallets on October 29.

The attack was far more calculated than a typical phishing scam. Hackers posed as recruiters, tricked engineers into installing malicious software, and accessed the infrastructure responsible for authorizing cryptocurrency transactions.

Binance co-CEO Richard Teng told CNBC’s “Squawk on the Street” that the attackers “spent months building their way in,” pushing back against suggestions that a single compromised laptop caused the breach.

“In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that,” Teng added. “In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security … from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction.”

The exchange disclosed the details in a November 3 security report, offering its first comprehensive account of how attackers moved from employee computers into systems controlling billions of dollars in customer assets.

The FBI attributed the theft to North Korean hackers linked to the Trader Traitor group. Teng acknowledged the FBI’s findings but stopped short of independently attributing the attack to North Korea.

How a fake job interview opened the door to Binance’s wallets

According to Binance’s investigation, the operation began in June when a wallet infrastructure engineer searched online for an AI coding tool and downloaded a tampered Homebrew installation.

Binance’s security team detected suspicious activity, replaced the engineer’s computer, and rotated affected credentials. The intervention came too late to prevent the attackers from learning about the employee’s responsibilities and identifying colleagues working on the exchange’s wallet infrastructure.

The hackers returned in September with a different approach.

This time, they approached another Binance engineer through a legitimate recruitment platform, posing as a company offering a job opportunity.

The engineer participated in what seemed like normal interviews with a recruiter and a company executive. The supposed employer then assigned a coding exercise and asked the engineer to download software onto a work computer.

The assignment contained malware capable of evading Binance’s endpoint security tools.

By October 20, the attackers had used the compromised computer and an internal AI tool to reach two additional wallet engineers’ devices. One of those devices contained deployment credentials that eventually gave the hackers access to Binance’s wallet-signing infrastructure.

Nine days later, the attackers struck.

On October 29, the stolen credentials let them deploy malicious code into the wallet environment. Within minutes, cryptocurrency began flowing out of Binance-controlled wallets.

The attackers initially transferred 233.46 million XRP from five hot wallets in roughly four minutes, followed by substantial withdrawals involving Bitcoin, Solana, Ethereum, and other cryptocurrencies.

The hackers exploited Ethereum’s EIP-7702 authorization mechanism to establish permissions that allowed further unauthorized transfers. Those permissions complicated Binance’s response, allowing some transactions to continue after the exchange suspended withdrawals.

The resulting losses reached approximately $6.34 billion.

Binance says 98% of affected assets have been replenished

Binance says it has replenished 98% of the affected token assets as of October 31, using company funds to cover the losses. The exchange is still purchasing less liquid cryptocurrencies needed to replace the remaining assets.

The company has pledged that customers will not bear the financial impact of the attack.

Binance reported that approximately $2.85 billion in stolen assets had been frozen or intercepted through coordination with law enforcement, blockchain investigators, and industry partners. That figure remains subject to reconciliation and changes in cryptocurrency prices.

The exchange has since rebuilt its affected wallet infrastructure and internal AI tool, replaced compromised employee devices, revoked exposed credentials, and expanded security scans across its workforce.

Teng said Binance plans to bring in independent cybersecurity experts to review the incident and recommend further improvements.

The breach raises uncomfortable questions for an industry that spends heavily on cryptographic security but still depends on human employees, software development environments, and internal access controls.

The attackers did not need to break Bitcoin’s encryption or defeat blockchain technology. They found a path through ordinary workplace activities, including software installation and recruitment interviews, before reaching systems trusted to authorize transactions.

The compromised AI tool adds another concern for financial institutions adopting AI across engineering and internal operations. Tools connected to sensitive company systems can become additional routes for attackers when access controls fail.

For Binance, replacing stolen assets addresses the immediate financial damage. Restoring confidence in the security of its infrastructure may prove a longer challenge.

The larger lesson extends beyond cryptocurrency: A company can invest billions in protecting its assets and still face catastrophic losses when attackers gain control of the systems authorized to move them.