Binance Postmortem Reveals How a Fake Job Interview and an AI Tool Led to the 6.34 Billion Dollar Hack

Binance says hackers stole about 6.34 billion dollars in digital assets on October 29, 2026, after a quiet campaign that lasted about five months. In its first findings report, published November 3, the exchange traced the attack from a trojanized software installer in June, through fake job interviews in September, to a rapid theft across ten blockchains in late October. The FBI later attributed the theft to TraderTraitor, a North Korean unit linked to Lazarus. Binance says it absorbed the loss itself, replenished about 98 percent of affected assets from its own reserves by October 31, and reported that no customer lost funds.

Quick Facts

How a Search for an AI Coding Tool Opened the Door

The story did not start with a dramatic break-in. According to Binance, it started in June 2026 with an ordinary work task. A Wallet DevOps engineer was looking for an AI coding tool and downloaded a Homebrew installer that had been trojanized. Homebrew is a popular package manager used by many developers on Mac computers, so the download would not have looked unusual on its own.

That single download gave the attackers a foothold. From there, they could work quietly inside the compromised computer and learn what systems the engineer could reach. Binance describes this as a long campaign, not a smash-and-grab attack, with a clear target: the wallet infrastructure.

This shows how modern attacks often begin. The entry point was not a weak password on a public server. It was a trusted-looking tool, installed by a skilled engineer who had no reason to suspect it.

Fake Job Interviews and a Coding Test

In September, the campaign moved to a tactic that has become familiar in crypto security cases: fake job interviews. Attackers approached a Binance engineer with what looked like a recruitment process, including a coding test. The test itself was the trap. It was designed to run malicious code or to open access on the target computer while the engineer believed he was simply showing his skills for a new role.

Fake interviews work because they play on ambition and routine. Engineers expect to download a project, run it, and fix a problem. When the test comes from a recruiter who sounds professional, the guard drops, and Binance says this step deepened the attackers’ access.

Binance has not presented this as a failure by one careless person. Each step gave the attackers a little more access and looked plausible in isolation, which is why one security control alone cannot stop such campaigns.

Timeline: From June to October 30

Binance laid out the campaign in a clear sequence, and the dates show how slow the build-up was compared with how fast the theft itself happened.

• June 2026: A Wallet DevOps engineer downloads a trojanized Homebrew installer while searching for an AI coding tool. The attackers gain their first foothold.
• September 2026: Attackers use fake job interviews and a coding test against a Binance engineer, deepening their access.
• October 20, 2026: Using the compromised computer and an internal AI tool, the attackers reach two more engineers on the wallet infrastructure team and obtain deployment credentials.
• October 29, 2026: The attackers deploy a container and exploit Ethereum EIP-7702 delegation to gain execution rights over the Binance 14 hot wallet. Funds move across ten blockchains in a short window.
• October 29, 2026, 23:56 UTC: The last unauthorized transfer, 2,961.9 ETH, settles.
• October 30, 2026, 00:10 UTC: Binance clears the malicious authorization, just fourteen minutes later.
• October 31, 2026: Binance says it has replenished about 98 percent of affected assets from its own reserves. The FBI attributes the theft to TraderTraitor.
• November 1, 2026: Withdrawals resume in phases.
• November 3, 2026: Binance publishes its initial findings report.

Five months of quiet preparation ended in a theft that played out in hours. Speed mattered at the end, but patience mattered far more at the start.

The Night of October 29: A Container, EIP-7702, and Ten Blockchains

On October 20, the attackers reached two more engineers on the wallet infrastructure team through the compromised computer and an internal AI tool. That step gave them deployment credentials, which are powerful because they allow code and changes to move into production systems. With those credentials, the attackers were in a position to act, not just to watch.

On October 29, they deployed a container and exploited Ethereum EIP-7702 delegation. In simple terms, delegation allowed them to gain execution rights over the Binance 14 hot wallet. A hot wallet is connected to the internet so it can move funds quickly for trading and withdrawals. That speed is useful for customers, but it also means that once an attacker gains execution rights, large amounts can move fast.

Binance says funds moved across ten blockchains in a short window. Spreading the theft across chains makes tracing and freezing harder. The last unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC, and at 00:10 UTC on October 30, Binance cleared the malicious authorization. By then, the bulk of the funds had already left.

What Binance Did After the Theft

Binance says about 2.85 billion dollars was frozen or intercepted with the help of partners. Freezing funds after a theft is a race. Exchanges, stablecoin issuers, and blockchain investigators must spot stolen funds, flag the addresses, and stop them from being swapped or cashed out. In this case, a large share was stopped, but a large share was not, which is why the net loss still ranks as the biggest on record.

The exchange also says it replenished about 98 percent of affected assets from its own reserves by October 31, absorbed the loss itself, and reported that no customer lost funds. Withdrawals resumed in phases from November 1. In the first 9.5 hours, Binance processed 4.65 billion dollars in withdrawals, with only 2.1 percent outflow, suggesting most customers did not rush to leave.

Binance is clear that this is a first account, not a final one. An independent review is ongoing, and later findings could add detail or change parts of the picture. Readers should treat the November 3 report as the exchange’s own initial explanation, not as the last word from investigators.

Attribution, Denial, and 57 Blocked Threats

On October 31, the FBI attributed the theft to TraderTraitor, a North Korean unit linked to Lazarus. Lazarus is a name that appears often in major crypto theft cases, and TraderTraitor is described as a related unit focused on targeting crypto workers and firms through social engineering. The attribution adds a geopolitical layer to what was already a huge financial crime.

Kim Yo Jong denied involvement and called the attribution politically motivated. Denials of this kind are common after attributions to North Korea, and they do not settle the question for investigators. What matters for the public record is that a US law enforcement agency put its name to the attribution within days, while Binance published its own technical timeline separately.

Binance also said its team blocked 57 suspected North Korea-linked cyber threats in 2026. Blocking 57 threats and still suffering one successful campaign shows that attackers can try many times, learn from failed attempts, and eventually find a path that works.

For wider context on how this theft fits into the market reaction and the recovery story, see how Bitcoin and Binance responded after the hack, crypto prices on November 2 as Bitcoin traded near 78,000 dollars, and the wider market slide driven by election results and AI data center fears. This article focuses on the attack path itself, while those stories cover the market side.

FAQs

How much was stolen in the Binance hack?

Binance says about 6.34 billion dollars in digital assets was stolen on October 29, 2026. That makes it the largest cryptocurrency theft on record, about four times the roughly 1.5 billion dollar Bybit theft of February 2025.

How did the attackers get in?

Binance traces the campaign to June 2026, when an engineer downloaded a trojanized Homebrew installer while searching for an AI coding tool. Fake job interviews and a coding test followed in September, and on October 20 the attackers used an internal AI tool to reach two more wallet infrastructure engineers and obtain deployment credentials.

Did Binance customers lose money?

Binance says no customer lost funds. It says it replenished about 98 percent of affected assets from its own reserves by October 31 and absorbed the loss itself. Withdrawals resumed in phases from November 1.

Who does the FBI blame for the hack?

The FBI attributed the theft on October 31 to TraderTraitor, a North Korean unit linked to Lazarus. Kim Yo Jong denied involvement and called the attribution politically motivated. Binance says an independent review is still ongoing.

Sources

• Cointelegraph: Binance fake job interviews and compromised AI tool hack
• TheStreet: How the 6.34 billion dollar Binance hack exploited internal AI agents
• CryptoCompass: Binance details the six-month campaign behind its 6.34 billion dollar hack and the 57 threats it stopped

Final Thoughts

The Binance postmortem is a warning about trust. A trusted installer, a plausible job interview, and a helpful internal AI tool each looked normal on their own. Together, they gave attackers a path from one engineer’s computer to a hot wallet holding billions. Exchanges need to check software sources, treat coding tests from strangers as untrusted code, and limit deployment credentials.

For readers, this is news about a crime and a security failure, not investment advice. The size of the theft matters, but the method matters more, because the same tricks are used against smaller firms and users every day. When a download, a job offer, or a helpful tool asks for trust, verify it first.