Binance Traces $6.3 Billion Hack to Fake Job Interview and Compromised AI Tool

The $6.3 billion Binance heist was not a brute-force cryptographic break, but a months-long social engineering campaign culminating in a fake job interview. On Tuesday, the cryptocurrency exchange released a detailed incident report explaining exactly how suspected North Korean hackers infiltrated its wallet infrastructure. The disclosure shifts the focus from blockchain vulnerabilities to human exploitation.[1][5]

The new timeline reveals that the October 29 theft was the final step of an operation that began in June. Hackers systematically mapped Binance's internal teams before deploying custom malware disguised as a coding test. By detailing the specific mechanics, the exchange has provided a rare, step-by-step look at how state-sponsored actors bypass modern enterprise security.[1][4]

"This was not a single mistake or a single breach. It was a campaign built over many months," Binance co-CEO Richard Teng told reporters. He noted that the attackers combined fake recruitment interviews, malicious software, and compromised devices. The company claims it has already replenished 98 percent of the affected token balances.[5]

The FBI formally attributed the attack to North Korea's TraderTraitor unit over the weekend, a charge Pyongyang has publicly denied. While the geopolitical standoff continues, the technical post-mortem offers a concrete blueprint of the threat. For cybersecurity professionals, the Binance report serves as a critical case study in defending against highly targeted, multi-stage intrusions.[2][3]

The initial foothold

The intrusion began in June 2026 when a Binance wallet infrastructure engineer, identified in the report as Engineer A, attempted to install a popular artificial intelligence coding tool. The employee unknowingly downloaded a tampered version of the Homebrew package manager. This initial compromise was delivered via a malicious advertisement rather than a direct attack.[3][4]

Binance's internal security systems detected the anomalous Homebrew installation almost immediately. The company moved swiftly to replace the affected device and rotate the employee's credentials, effectively shutting down that specific access point. However, the brief window of exposure proved to be enough for the attackers to gather critical intelligence.[1][3]

During that initial breach, the hackers successfully mapped the roles and identities of the wallet development team. They learned who had access to the exchange's most sensitive infrastructure. This reconnaissance allowed the attackers to shift their strategy from opportunistic malware distribution to a highly targeted spear-phishing campaign.[3][4]

Rather than attempting another direct technical exploit, the hackers spent the next three months preparing a social engineering trap. They used the organizational chart they had extracted to identify a specific, high-value target within the wallet team. This pivot demonstrates the patience and adaptability of the TraderTraitor group.[3][5]

The fake interview trap

In September, the attackers initiated the second phase of their campaign by contacting a different employee, dubbed Engineer B, through a legitimate professional networking platform. The hacker posed as a project director for a fictitious company, offering a lucrative career opportunity. This tactic aligns with known North Korean cyber-espionage methods targeting the cryptocurrency sector.[3][5]

To build trust, the attackers conducted a live video interview with the engineer. The fake human resources representative shared a social media profile populated with personal photos and videos, creating a convincing digital footprint. The elaborate setup was designed to bypass the natural skepticism of a senior software developer.[1][4]

During a subsequent interview conducted over a popular social chat application, the chief executive of the fake company asked the engineer to complete a technical assessment. The applicant was instructed to download a coding assignment from an online repository onto their Binance work laptop. This repository contained the payload that would ultimately compromise the exchange.[1][5]

The downloaded file harbored a previously unseen strain of custom malware that successfully evaded Binance's endpoint antivirus software. Once executed, the malicious script quietly deleted the legitimate executable on the machine. It then renamed its own malicious file to match the deleted program, modifying symbolic links to hide its presence.[1][3]

Escalation and lateral movement

By masquerading as a standard Python development tool, the malware allowed the attackers to spawn a hidden command shell process. This established a persistent, undetected communication channel with an external server controlled by the hackers. For weeks, the compromised laptop sat inside Binance's secure network, waiting for the next phase.[1][4]

On October 20, the attackers used the compromised machine to begin moving laterally across the company's internal systems. According to the incident report, they exploited an unspecified internal artificial intelligence tool to compromise the computers of two additional wallet engineers. This lateral movement gave them access to the credentials needed to authorize massive transactions.[1][5]

The specific role of the internal AI tool remains one of the most opaque elements of the disclosure. Binance has not clarified whether the tool itself contained a vulnerability, or if it was simply used to automate the discovery of internal network paths. Security researchers note that AI-assisted lateral movement represents a significant escalation in attacker capabilities.[4][5]

With control over multiple developer machines, the hackers acquired a container deployment token. This token granted them the administrative privileges required to interact directly with Binance's wallet signing service. They were now positioned to bypass the standard customer withdrawal interfaces entirely.[1][4]

The October 29 heist

The actual theft unfolded rapidly on the evening of October 29, beginning at 20:05 UTC. Using the stolen credentials, the attackers deployed a malicious script that initiated unauthorized transfers across ten different blockchains. Because the transactions originated from the internal wallet signing service, they appeared legitimate to the network's automated safeguards.[1][5]

As billions of dollars began draining from the hot wallets, Binance's security team detected the anomaly and suspended all customer withdrawals. However, the attackers had anticipated this countermeasure. They exploited Ethereum's EIP-7702 authorization mechanism, a recent protocol update, to continue siphoning assets even after the primary withdrawal systems were locked down.[1][4]

Within approximately 20 minutes, the hackers successfully transferred $6.34 billion in digital assets into wallets under their control. It stands as the largest single cryptocurrency theft in history, dwarfing the $1.5 billion Bybit hack from early 2025. The sheer speed of the extraction highlights the efficiency of the malicious script.[1][5]

Following the breach, Binance launched a massive recovery effort in coordination with blockchain analytics firms and international law enforcement. The company successfully froze or intercepted approximately $2.85 billion of the stolen funds across various networks. However, the remaining $3.49 billion remains outside the reach of centralized authorities.[1][5]

Financial impact and recovery

Despite the staggering headline figure, Binance asserts that its users will not bear the financial burden of the attack. The company announced that it has utilized its Secure Asset Fund for Users and corporate reserves to cover the losses. As of October 31, roughly 98 percent of the affected token balances had been replenished.[5]

The company remains in very strong financial health, Teng stated during a fintech event following the disclosure. He emphasized that the exchange had set aside sufficient funds to manage such catastrophic events, noting that the missing assets represent only about 3.1 percent of the platform's total holdings. Customer withdrawals resumed on Sunday and have since normalized.[5]

The exchange has completely rebuilt the affected wallet infrastructure and revoked all compromised credentials. Binance also announced plans to increase its investment in AI-enabled threat detection systems to counter similar sophisticated intrusions. An independent cybersecurity review of the entire platform is currently underway to identify any remaining vulnerabilities.[1][5]

While the immediate financial crisis appears contained, the geopolitical fallout continues to escalate. The FBI's formal attribution to North Korea's TraderTraitor unit underscores the regime's reliance on cybercrime to fund its weapons programs. Pyongyang's subsequent denial sets the stage for further diplomatic friction over state-sponsored digital theft.[2][3]

The human element

For the broader technology sector, the Binance hack serves as a stark reminder that human vulnerability remains the ultimate attack vector. A multi-round interview process complete with video calls creates a deep false sense of security, exploiting a professional's natural desire for career advancement. As social engineering tactics become increasingly elaborate, corporate security training must evolve to match the threat.[3][4]

Ultimately, the $6.3 billion heist demonstrates that securing a cryptocurrency exchange requires more than just protecting private keys. It demands comprehensive operational security that accounts for the human element across the entire organization. Until the industry addresses these sophisticated social engineering tactics, state-sponsored hackers will continue to find lucrative targets.[1][5]