Binance says a fake job interview and internal AI access enabled the $6.34bn theft

Binance says attackers spent months compromising members of its wallet engineering team before stealing about $6.34 billion in cryptoassets on 29 October 2026. The exchange’s preliminary investigation describes a chain of compromises involving a poisoned software download, a fake recruitment process, malware and an internal AI tool before the attackers reached wallet-signing operations.

This is a separate write-up from earlier coverage of the phased withdrawal restart and North Korea’s denial of the FBI attribution. The new material is Binance’s account of how the intrusion unfolded.

The FBI has attributed the theft to North Korea-linked TraderTraitor activity. North Korea has denied involvement. Blockchain analytics firm Elliptic values the stolen assets at about $6.43 billion and describes the incident as the largest cryptoasset theft on record.

The intrusion began months before the theft

According to Binance, the first known step came in June. A Wallet DevOps engineer searched online while trying to install a popular AI coding tool and downloaded a tampered version of Homebrew. Binance says its security team detected the anomaly, replaced the device and rotated related credentials, but the attackers had already learned the engineer’s role and the identities of colleagues working on wallet infrastructure.

In September, a second engineer was approached through a legitimate job-search platform by someone posing as a project director. The recruitment process included a live video interview with a supposed HR representative and a second interview with someone claiming to be the CEO of a fictitious company. Near the end of that process, the engineer was told to download a technical assignment containing a malicious code repository onto a work computer.

Binance says the malware evaded endpoint protection and established access to an attacker-controlled server. On 20 October, the attackers then used the compromised computer and an internal AI tool to gain control over machines used by two other wallet engineers. They discovered a container deployment token on one of those devices.

On 29 October, Binance says the attackers accessed another engineer’s computer, used stolen credentials, deployed a container and triggered malicious code against the exchange’s wallet-signing infrastructure. Elliptic’s later laundering analysis recounts the same multi-stage path.

Why stopping withdrawals did not stop every transfer

The attackers first moved assets from hot wallets across several networks. On Ethereum, Binance says they exploited the EIP-7702 authorization mechanism to delegate execution rights from a hot wallet to a smart contract they controlled.

That distinction mattered during incident response. Suspending normal withdrawals and shutting down hot-wallet services did not automatically cancel the on-chain delegation. Binance also says the affected wallet used multi-party computation, so there was no single private key that could simply revoke the authorization. The exchange had to develop and execute additional on-chain transactions to remove the malicious permissions.

Binance says the final unauthorized transfer was confirmed at 23:56 UTC on 29 October, nearly four hours after the first theft activity. It removed the EIP-7702 delegation shortly after midnight UTC on 30 October.

Billions remain traceable, but cashing out is harder

Elliptic’s analysis, updated on 5 November, says $2.85 billion of the stolen assets has been frozen or seized. About $3.35 billion remains in addresses linked to the theft, mostly in bitcoin and ether, while only a negligible amount appears to have been converted into spendable fiat currency.

The laundering operation has nevertheless been extensive. Elliptic counted about 12,000 wallets across 11 blockchains and more than 40,000 transactions during the first three and a half days. Around $786 million in stablecoins was converted before issuers and other participants froze the rest. By 5 November, about 33 BTC, worth roughly $2.7 million at the time, had also passed through Wasabi-style coinjoins.

Elliptic expects attempts to cash out through exchanges or over-the-counter brokers to take months. The remaining bitcoin and ether cannot be frozen by a central token issuer, but converting billions into usable money requires counterparties that can identify and block funds linked to the theft.

For Binance users, the recovery is still incomplete. The exchange said on 4 November that it had replenished about 98% of the affected assets from its own resources, up from the 95% figure reported earlier, and published a Proof of Reserves snapshot covering 44 tokens. Withdrawals continued to reopen in stages; a 6 November update added another batch of network and asset pairs rather than declaring withdrawals fully restored.