Cryptocurrency exchange Binance has disclosed how cybercriminals used fraudulent job interviews, malicious software and an internal artificial intelligence (AI) tool to infiltrate its systems before carrying out a cryptocurrency theft estimated at $6.34 billion.
The world’s largest cryptocurrency exchange published its initial investigation findings on November 3, 2026, revealing that the attack was not a single security breach but a carefully coordinated operation that developed over several months.
The incident, which took place on October 29, has been described as one of the biggest cryptocurrency thefts in history. It has also raised fresh concerns about the security of digital asset platforms and the growing use of sophisticated recruitment scams to target employees.
Binance Chief Executive Officer Richard Teng described the incident as a prolonged campaign involving several stages of infiltration. He said the company was taking responsibility for the disruption and working to ensure affected customers did not suffer financial losses.
Fake recruitment interviews used to target Binance employee
According to Binance’s investigation, the operation began in June 2026 when an employee working on the company’s wallet infrastructure downloaded a modified version of an AI coding tool.
The software had been tampered with by attackers, allowing them to gain information about the employee and other members of the team responsible for managing Binance’s cryptocurrency wallet systems.
Although the exchange detected the suspicious activity, replaced the affected device and changed the relevant access credentials, the attackers had already obtained information that helped them identify other potential targets.
A second stage began in September when another Binance software engineer was approached through a legitimate job-search platform by an individual pretending to be a project director.
The fake recruiter arranged a series of interviews, including a video conversation with someone posing as a human resources representative and another interview with an individual claiming to be the chief executive of a fictitious company.
To make the recruitment process appear genuine, the supposed recruiter reportedly used a social media account containing personal photographs and videos to build trust with the employee.
During the second interview, the engineer was instructed to download a coding assignment onto his work computer.
However, the assignment contained malicious software disguised as a legitimate coding repository. Installing the files triggered unauthorised activities on the employee’s device, giving the attackers another route into Binance’s internal systems.
Hackers exploited internal AI tool
Binance said the attackers later used the compromised computer alongside an internal AI tool to gain access to systems used by two other engineers working on the exchange’s wallet infrastructure.
The activity reportedly occurred on October 20, nine days before the cryptocurrency theft.
By exploiting compromised devices and stolen credentials, the hackers were able to move deeper into the company’s technical environment and obtain access needed to execute unauthorised transactions.
The exchange explained that the attackers eventually deployed a container and activated a malicious script using credentials taken from one of the compromised engineers.
The incident demonstrates how cybercriminals can combine traditional social engineering techniques with weaknesses in software development systems and internal digital tools.
Rather than attempting to break through every security barrier directly, the attackers reportedly exploited the trust placed in recruitment processes and legitimate-looking software assignments.
The use of an internal AI tool also highlights the possibility that emerging workplace technologies can become security risks when access controls and monitoring systems are insufficient.
$6.34 billion in digital assets affected
The attack was carried out on October 29, when hackers gained access to Binance’s wallet infrastructure and moved large quantities of cryptocurrency into unauthorised accounts.
According to Reuters, the attackers initially transferred approximately 233.46 million XRP from five internet-connected wallets within four minutes before moving other digital assets.
Binance detected unusual transactions and began efforts to suspend withdrawals, freeze affected tokens and remove unauthorised permissions.
The exchange said approximately $2.85 billion in assets had been frozen or intercepted through cooperation with law enforcement agencies, cryptocurrency issuers and blockchain intelligence companies.
However, the attack continued for several hours as the company worked to revoke compromised permissions and stop further unauthorised transfers.
Binance said it had replenished approximately 98 per cent of the affected assets by November 3 and was working to restore the remaining portion.
Richard Teng also stated that the company had set aside sufficient funds to cover the affected assets, adding that customers would not bear the losses resulting from the incident.
FBI links attack to North Korean hackers
The United States Federal Bureau of Investigation (FBI) has attributed the cryptocurrency theft to North Korea, identifying the suspected perpetrators as members of a hacking operation known as TraderTraitor.
The group has previously been linked to cryptocurrency thefts and cyber operations targeting digital asset companies.
North Korea, however, has rejected the accusation.
Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, dismissed the FBI’s claims as a political provocation and accused Washington of attempting to associate her country with international cybercrime.
The disagreement adds another diplomatic dimension to the incident, as international authorities continue investigating the growing threat posed by state-linked cyber operations.
Binance has not independently established the identities of all individuals involved in the attack in its initial public report. The FBI’s attribution should therefore be understood as the US government’s position rather than an uncontested finding.
Binance promises stronger cybersecurity measures
Following the incident, Binance announced plans to strengthen its security infrastructure and improve its ability to identify suspicious activity before attackers can gain control of sensitive systems.
The company said it would increase investment in AI-powered threat detection and establish a security research fund focused on artificial intelligence and blockchain technology.
It is also bringing in independent cybersecurity specialists to conduct a further assessment of the incident and identify weaknesses that require attention.
The exchange has begun rebuilding affected systems, reviewing access permissions and strengthening controls around employee devices and internal development tools.
The incident has also renewed warnings about fraudulent recruitment exercises, particularly those involving coding assignments and requests to install unfamiliar software.
Cybersecurity specialists have repeatedly cautioned that job applicants should verify prospective employers and avoid downloading files or running programmes from untrusted sources during recruitment processes.
For cryptocurrency businesses, the Binance incident highlights the importance of treating employee security as a critical part of protecting digital assets.
As the investigation continues, the exchange faces the task of restoring confidence among customers and demonstrating that its systems can withstand increasingly sophisticated cyberattacks.
