Binance says $6.3 billion hack began with a fake job interview
Author: Crypffalo Research · 00:56 04/11/2026
Binance's incident report says attackers spent months inside its systems, starting with a fake job interview and an internal AI tool, before draining $6.3 billion on Oct. 29.
Binance on Nov. 3 published an initial incident report on the roughly $6.3 billion drained from its hot wallets on Oct. 29. The exchange said the attack was not a single slip but a campaign that played out over several months.
It started with a fake job interview aimed at a Binance software engineer. Binance says about $2.85 billion has been frozen or intercepted and 98% of affected assets have already been replenished.
Key takeaways
- Entry point: An engineer received a "coding assignment" after a sham interview that carried zero-day malware able to evade endpoint security.
- Lateral movement: On Oct. 20, attackers used the infected machine and an internal AI tool to reach two wallet engineers' computers.
- Drain window: Funds began leaving hot wallets at 20:05 UTC on Oct. 29, and containment was completed at 00:10 UTC on Oct. 30.
- Recovery: About $2.85 billion has been frozen or intercepted, and 98% of impacted assets were replenished with company funds.
- Attribution: Binance cited the FBI's finding that North Korea was behind the attack.
A campaign built over months
According to chief security officer Jimmy Su, the first warning signs date back to June. A wallet DevOps engineer installed a tampered version of Homebrew while searching for an AI tool.
Binance caught it, replaced the device and rotated credentials. But the engineer and colleagues on the wallet team remained exposed to the same group.
The main milestones, per the report:
- June: A wallet engineer installs tampered Homebrew; Binance swaps the device and rotates credentials.
- September: A software engineer is approached on a job platform by a fake "Project Director," then interviewed on video by a fake HR rep and a fake CEO.
- Oct. 20: From the infected machine, attackers use an internal AI tool to reach two wallet engineers, one with container deployment rights.
- Oct. 29: Stolen credentials are used to deploy a container and run a malicious script; funds start moving at 20:05 UTC.
- Oct. 30: The breach is contained at 00:10 UTC.
Why the hot wallet could not be locked fast
CoinDesk reported that the attacker used EIP-7702 to gain execution rights over a hot wallet. Because Binance's hot wallets rely on multiparty computation, there was no single key that could revoke that access instantly.
CEO Richard Teng wrote on X that "this wasn't one mistake or one breach," calling it a months-long campaign. Binance also apologized to users and partners for the disruption.
The exchange says it has closed the entry points, rebuilt or replaced affected systems, tightened device controls and expanded AI-based anomaly detection. It is also bringing in independent cybersecurity experts for a review.
Binance said it has blocked 57 suspected North Korea-linked attempts so far in 2026. Pyongyang on Nov. 2 rejected the FBI's attribution.
What it means for crypto markets
The report does not change the loss figure, but it makes clear the weak point was people and internal tooling rather than smart contract code. Bitcoin is trading around $77,500, per CoinDesk and Bitcoin Magazine, after dipping to $76,300 earlier in the day.
- Bull case: A clear root cause, 98% of assets restored and Binance's note that hourly deposits now exceed withdrawals could help sentiment stabilize.
- Risk case: The fake-recruiter and AI-tool playbook could be reused against other exchanges or funds, while US and South Korean regulators step up pressure on offshore venues.
The disclosure also lands on US midterm election day, when markets were already cautious on risk assets.
What to watch next
- The full report and the independent security review Binance has promised.
- The final 2% of assets Binance is still buying back, mostly less-traded tokens.
- Binance net flows as withdrawals reopen, and how the CFTC responds on offshore exchanges.
- Price moves and liquidations around the US election results; see real-time liquidations and the economic calendar.
Frequently Asked Questions
Did Binance users lose money?
Binance says all customer funds are safe because it used company funds to replenish 98% of affected assets. The remainder is still being acquired.
How did the hackers get in?
According to the report, they planted malware through a coding test after a fake job interview, then used an internal AI tool to reach wallet engineers' machines.
Who is behind the hack?
Binance cites the FBI's conclusion that North Korea was responsible, while North Korea has denied involvement.
*This content is for information only and is not financial advice.*
Tags: Binance, Hack, Security, North Korea
Related articles
- Bitcoin Reclaims $80,000 as Over $400 Million Liquidated in One Hour
- Bitcoin Rebounds to $78,500 From 7-Week Low as Spot ETF Outflows Slow to $116M
- ZachXBT names French bank Crédit Mutuel Arkéa in alleged $133M crypto theft
- Binance flips to roughly $2B in daily net inflows as post-hack withdrawals cool
- Bitcoin ETFs Bleed $399M in Second Day of Outflows as BTC Slips to $76,500
- Binance Opens Phase 2 Withdrawals on 9 Networks as Net Outflows Drop to $2.57B