Summarize this news article with AI:
Ask ChatGPT 
Ask Grok 
Ask Perplexity 
Ask Claude 
Ask Google AI Cryptocurrency exchange Binance has revealed that hackers used fake job interviews, malicious software, and a compromised internal AI tool in a cyberattack that resulted in approximately $6.34 billion in stolen digital assets on October 29, 2026. The attack developed over several months and involved compromising multiple employees before gaining access to the exchange's cryptocurrency wallets. The FBI has attributed the theft to North Korea, while Binance says it has rebuilt affected systems and is working to recover the stolen funds.
What Happened in the $6.3 Billion Binance Hack?
On November 3, Binance released its initial security investigation findings, explaining how attackers infiltrated its systems through a coordinated campaign that began months before the theft.
Rather than directly attacking the exchange's cryptocurrency wallets, the hackers first targeted employees responsible for maintaining the company's wallet infrastructure.
The investigation identified a series of compromises involving malicious software downloads, fraudulent recruitment interviews, and unauthorized access to internal systems.
The attackers eventually reached an internal wallet signing service, which allowed them to initiate unauthorized cryptocurrency transactions outside Binance's normal withdrawal process.
The October 29 attack affected multiple cryptocurrency wallets across different blockchain networks. Binance reported losses involving Bitcoin (BTC), XRP, Solana (SOL), Optimism (OP), and other digital assets.
How Hackers Used Fake Job Interviews and an Internal AI Tool
According to Binance, the attack unfolded in several stages between June and October 2026.
June 2026: Malicious Software Compromises an Engineer
The first identified stage occurred in June, when a Binance wallet infrastructure engineer downloaded a modified Homebrew installer while attempting to install a popular AI coding tool.
The malicious installer exposed information about the engineer's role and colleagues involved in managing the company's cryptocurrency wallet infrastructure.
Binance said its security team detected the suspicious activity, replaced the affected computer, and renewed the associated credentials. However, the attackers had already gained information that could support further targeting.
This stage involved a compromised software installer, a technique associated with software supply chain attacks.
September 2026: Fake Recruitment Interviews Deliver Malware
In September, another Binance software engineer was contacted through a legitimate job-hunting platform by someone claiming to represent a technology company.
The engineer participated in two interviews, including a video meeting with a supposed human resources representative and a separate conversation with someone impersonating the company's CEO.
The attackers used social media profiles containing photographs and videos to make their identities appear credible.
During the recruitment process, the engineer was instructed to download a coding assignment. The downloaded repository contained malicious code that executed during setup, compromising the employee's work computer.
The technique combined malware with social engineering, in which attackers manipulate individuals into performing actions that expose systems or information. Such tactics are also used in phishing attacks.
October 20: Attackers Exploit an Internal AI Tool
On October 20, the attackers used the compromised engineer's computer and an internal Binance AI tool to gain control of two additional employees' devices.
During this stage, they discovered that one engineer's computer contained a token granting permission to deploy software containers.
This access became a critical part of the subsequent attack.
Binance's findings describe the AI tool as part of the attackers' route into additional systems. The company has not identified the tool as an autonomous attacker or claimed that an AI model independently carried out the cryptocurrency theft.
October 29: Hackers Steal Billions in Cryptocurrency
On October 29, the attackers accessed another engineer's computer, used previously stolen credentials, and deployed a malicious container that triggered the wallet attack.
The hackers gained unauthorized access to a wallet signing service and initiated cryptocurrency transfers.
Binance said the attackers also exploited Ethereum's EIP-7702 authorization mechanism to delegate certain execution permissions to an attacker-controlled smart contract.
This complicated containment because some unauthorized transfers could continue independently of Binance's normal withdrawal infrastructure.
How Much Cryptocurrency Was Stolen from Binance?
Binance reported that approximately $6.34 billion in digital assets were affected by the October 29 cyberattack.
The company disclosed several major unauthorized transfers, including:
- 233.46 million XRP transferred from five Binance hot wallets.
- Approximately 970,500 SOL transferred from wallets on Solana.
- Approximately 44.2 million OP transferred from wallets on Optimism.
- 18,270 BTC transferred to an attacker-controlled address.
Additional unauthorized activity involved Ethereum-based assets.
Binance temporarily suspended withdrawals as it investigated the incident and attempted to prevent further unauthorized transfers.
In its November 3 update, the company said approximately $2.85 billion in digital assets had been frozen or intercepted. The amount remains subject to reconciliation and cryptocurrency price fluctuations.
Binance also stated that it would absorb the financial impact rather than pass the losses on to users.
As of October 31, the exchange reported that 98% of the affected token assets had been replenished, with the remaining assets still being purchased.
FBI Attributes Binance Hack to North Korea
On October 31, the Federal Bureau of Investigation attributed the theft to North Korean cyber actors associated with an operation it calls TraderTraitor.
The FBI said the attackers had begun converting stolen cryptocurrency into Ether and warned that further laundering could involve decentralized finance platforms and instant cryptocurrency exchange services.
US authorities urged cryptocurrency service providers and blockchain infrastructure operators to identify and block transactions associated with the stolen assets.
North Korea has rejected the allegations linking it to the attack.
The attribution remains that of US law enforcement. Binance's published investigation describes the attack methods and acknowledges the FBI's findings.
Binance's Response and Latest Updates
Following the breach, Binance began rebuilding its affected infrastructure and replacing compromised devices.
In its November 3 security update, the company confirmed several completed measures:
- Rebuilding the affected wallet system in a new environment.
- Rebuilding the compromised internal AI tool and its access controls.
- Replacing affected employee devices.
- Disabling credentials and access tokens linked to compromised engineers.
- Conducting additional security scans across employee devices.
- Strengthening wallet security controls and AI-based behavioral monitoring.
- Coordinating with authorities and blockchain intelligence companies to trace and freeze stolen assets.
These measures involved changes to the company's security operations, including incident investigation, compromised-device remediation, and monitoring.
Binance has also announced plans for an independent cybersecurity review by external specialists.
Although the company says the identified attack entry points have been closed, its investigation remains ongoing.
Key Takeaways
- $6.34 billion was affected: Binance confirmed that hackers stole digital assets during the October 29, 2026 cyberattack.
- Fake job interviews were part of the attack: Criminals impersonated recruiters and company executives to persuade an engineer to download malware.
- An internal AI tool was compromised: Attackers used it as part of their effort to access additional employee devices.
- North Korea was blamed by the FBI: US authorities attributed the theft to North Korean cyber actors identified as TraderTraitor.
- Recovery and investigation continue: Binance reported that approximately $2.85 billion had been frozen or intercepted and that 98% of affected token assets had been replenished as of October 31.
Sources
- Binance: October 29, 2026 Security Incident, Initial Findings and Response Update, November 3, 2026.
- BBC News: Binance Says Fake Job Interviews Used as Part of $6.3bn Crypto Hack, November 3, 2026.
- Financial Times: AI Cyber Breach of a Bank Is a Matter of When, Not If, November 4, 2026. Opinion and contextual reference.
- FBI: North Korea Responsible for $6 Billion+ Binance Attack, October 31, 2026.
- Financial Times: Binance Hackers Used Fake Interviews and Social Media Profiles in $6.3bn Heist, November 3, 2026.
FAQ
According to Binance's November 3 investigation, the attack involved malicious software downloads, fake recruitment interviews, compromised employee computers, and unauthorized access to an internal AI tool. The attackers ultimately accessed a cryptocurrency wallet signing service, enabling unauthorized transfers on October 29, 2026.
Attackers impersonated representatives of a fictitious company and contacted a Binance engineer through a legitimate recruitment platform. After conducting fraudulent interviews, they instructed the engineer to download a coding assignment containing malware. The malicious code compromised the employee's work computer.
Binance reported that the attackers compromised an internal AI tool and used it to help access additional engineers' devices. However, the available investigation does not establish that an autonomous AI system independently planned or executed the cryptocurrency theft.
Binance reported on November 3 that approximately $2.85 billion in stolen digital assets had been frozen or intercepted. It also said 98% of affected token assets had been replenished as of October 31. Replenishing customer assets is not the same as recovering the stolen cryptocurrency, and the investigation remains ongoing.
