Binance traces $6.3 billion hack to fake job interview

Binance said on Tuesday, November 3, that the $6.3 billion theft from its wallets began months earlier with a tampered coding tool and a fake job interview. Hackers then used an internal artificial intelligence tool to take control of the exchange's wallets, Reuters reported. The exchange laid out the details in an initial report and a media briefing. It apologized and said it would spend more on AI-enabled detection after what may be the largest financial heist on record.reuters.com

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in its report, according to Reuters.reuters.com

A months-long campaign

The breach started in June. An engineer on the wallet team downloaded a tampered version of the Homebrew software package after clicking an internet ad, Fortune reported. Binance caught it and replaced the device, but the engineer's role and those of colleagues on the wallet team had already been exposed. In September, a second engineer was approached on a job platform by someone posing as a project director, chief security officer Jimmy Su said, per CoinDesk. After video interviews with a fake HR representative and a fake CEO, he downloaded a coding "assignment" containing zero-day malware that got past endpoint security. Fortune said the outreach happened on LinkedIn Microsoft Corporation ↘ 3.58%, and that Binance does not allow employees in non-public roles to keep profiles there.fortune.com+1

On October 20, the attackers used the compromised machine and an internal AI tool to reach two wallet developers' computers. On October 29, they used stolen credentials to run a malicious script. Funds started leaving at 20:05 UTC, and the attack was not contained until 00:10 UTC on October 30, CoinDesk reported. Su said the hackers used an Ethereum ↘ 0.93% feature called EIP-7702 to gain execution rights over a hot wallet.coindesk.com

Recovery and response

Co-CEO Richard Teng said about $2.85 billion has been frozen and about 98% of affected tokens have been replaced with company funds. He added that users won't be affected, CoinDesk reported. Fortune said stablecoin freezes by Tether and Circle ↘ 8.72% helped, and that Binance is buying the last 2%, made up of lesser-used tokens. Binance will bring in independent experts to review the incident. It also said it blocked 57 suspected North Korea-linked attempts this year.coindesk.com

North Korea denies role

The FBI has attributed the theft to TraderTraitor, a North Korean state-backed group also blamed for the roughly $1.5 billion Bybit hack in 2025, DW reported. In a statement carried by state media, Kim Yo Jong, sister of leader Kim Jong Un, called the accusation "absurd rhetoric" and "a grave political provocation," ABC News reported. President Donald Trump said over the weekend, "We don't know if it's North Korea," according to the Associated Press.amp.dw.com+2

Teng described the attack as "a campaign, built over many months," CoinDesk reported.coindesk.com