Hackers used fake job interviews, infected developer software and access to an internal artificial intelligence tool in the months before a $6.34 billion cryptocurrency theft from Binance, according to the exchange’s first detailed investigation.
The attack on 29 October 2026 is believed to be the largest cryptocurrency theft recorded. Binance’s incident report, published on 3 November, describes a campaign that began in June and involved computers belonging to three engineers with access to its digital-wallet infrastructure.
The US Federal Bureau of Investigation (FBI) has attributed the theft to North Korea’s TraderTraitor operation. North Korea rejects that accusation. Binance’s account of the attack is preliminary and remains subject to independent security review.
How the Binance attack unfolded
- June 2026: A wallet infrastructure engineer downloaded a tampered Homebrew installer while trying to install an AI coding tool after an online search. Binance says its security team detected the incident, replaced the laptop and changed affected credentials. The attackers had nevertheless learned about the engineer’s work and colleagues.
- September: A second engineer was contacted through a genuine job-search platform by someone posing as a recruiter. After a video interview and a further conversation with a person claiming to be a fictitious company’s chief executive, the engineer was given a coding assignment containing malware. Binance says the malicious code ran during setup on the employee’s work computer.
- 20 October: According to Binance, the intruders used that compromised computer and an internal AI tool to gain control of two other engineers’ systems. They also identified a token granting permissions to deploy software containers.
- 29 October: The attackers used a third engineer’s computer, stolen credentials and a malicious script to access wallet-signing operations and initiate unauthorised cryptocurrency transfers.
The report suggests the theft was not caused by a single successful phishing email. Instead, attackers combined impersonation, infected software, compromised devices and internal access obtained over several months.
What role did artificial intelligence play?
Binance says its internal AI tool was used as a springboard to reach engineers’ computers. That is different from saying an AI model independently planned or carried out the theft. Binance has not publicly identified the particular internal tool or provided enough technical detail to establish precisely how it was abused.
The June incident also involved an attempt to install a popular AI coding tool, but the initial infection came through a tampered software installer rather than through the legitimate AI assistant itself.
This distinction matters: the reported failure involved malicious downloads and access controls around employee systems. It does not establish that generative AI was autonomously responsible for stealing the assets.
Why did the theft continue after Binance raised the alarm?
Binance says five internet-connected wallets transferred 233.46 million XRP in just four minutes between 20:05 and 20:09 UTC on 29 October. Other unauthorised transfers included Solana, Optimism and Bitcoin assets.
The intruders also exploited an Ethereum transaction-authorisation feature known as EIP-7702. In simplified terms, it enabled an attacker-controlled smart contract to exercise certain powers over a wallet. Binance says these blockchain permissions could continue operating even after ordinary customer withdrawals were suspended.
The exchange had to develop a separate procedure to revoke those permissions. Its report says the final unauthorised transfer was completed at 23:56 UTC, nearly four hours after the initial XRP movements. These technical findings have not yet been independently validated in the published review.
How much money has been recovered, and are customers protected?
Binance puts the value of affected digital assets at approximately $6.34 billion. It says about $2.85 billion has been frozen or intercepted, although that figure is subject to reconciliation and changes in cryptocurrency prices.
Frozen assets are not necessarily recovered assets. Preventing stolen cryptocurrency from moving is not the same as returning it to its rightful owner.
Separately, Binance says it has set aside enough company funds to cover the loss. As of 31 October, it reported replenishing 98% of the affected token assets and said it was still obtaining the remaining, less liquid tokens. That is Binance’s reported replacement progress, not a claim that 98% of the stolen cryptocurrency was recovered from the hackers.
Binance has pledged that users will not bear the financial loss. Customers should continue to consult official Binance channels for account-specific withdrawal and balance information. Fish 4 News previously reported on the initial theft, the freezing of stablecoins and Binance’s promise to cover losses.
Who is accused of carrying out the attack?
In a statement dated 31 October, the FBI attributed the theft to North Korea and identified the operation as TraderTraitor. US investigators say they have observed the perpetrators converting stolen assets into Ether and urged cryptocurrency services to block transactions involving identified wallets.
North Korea has denied responsibility. The FBI’s conclusion is an official law-enforcement attribution, not a court finding identifying and convicting particular individuals.
What happens next?
Binance says it has replaced affected devices, revoked credentials, rebuilt parts of its wallet infrastructure and the internal AI tool, and strengthened security monitoring. It has also commissioned an independent cybersecurity review, whose findings have not yet been published.
The exchange says it detected and blocked 57 suspected North Korea-linked cyber threats during 2026. It plans further investment in detection, endpoint protection and a security research fund.
Important unanswered questions include exactly how the internal AI tool was exploited, whether the independent investigation will corroborate Binance’s full account and how much of the frozen cryptocurrency can ultimately be returned.
