Binance Says $6.34 Billion Hack Began With a Fake Job Interview and a Compromised AI Tool

Published November 3, 2026, 10:20 PM PKT. Based on Binance's initial incident report, "Initial Findings and Response Update," published November 3, 2026 (primary source), and reporting by Bitcoin Magazine on November 3, 2026, crypto.news on November 3, 2026, Unchained on November 3, 2026, and Blockchain.News on November 3, 2026 (secondary sources). This is MABOnChain's follow-up to its October 30 article on the compromised DevOps laptop, its November 1 article on the resumption of withdrawals, and its November 3 articles on Binance's second withdrawal phase and proof of reserves; the new angle is Binance's first full account of how the attack unfolded, including the fake job interview and the internal AI tool, which earlier coverage did not contain.

Binance published its first full account of the October 29 attack on November 3, 2026, and the account reframes the theft as a months-long campaign rather than a single breach. The exchange said about $6.34 billion in digital assets were impacted, about $2.85 billion had been frozen or intercepted, subject to reconciliation and market price volatility, and 98 percent of affected token assets had been replenished as of October 31, 2026, with the remaining, more illiquid assets being purchased. Binance said it has set aside more than 100 percent of the funds required to cover the loss, that it will absorb the financial impact, and that users will bear no losses. The company described the findings as its initial report, said the investigation remains ongoing, and said independent security firms will review the incident further, while some technical details will stay confidential.

The June download and the September fake interview

The campaign began, according to Binance, in June 2026, when a Wallet DevOps engineer, identified only as Engineer A, searched for a popular AI coding tool and downloaded a tampered Homebrew installation. Binance said its security team detected the anomaly, replaced the device, and rotated all related credentials, but the episode exposed Engineer A's role and the colleagues on the wallet infrastructure team to the attacker. Binance also said its security team detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, using techniques that included fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.

The decisive social engineering step came in September 2026, according to Binance. A software engineer, identified only as Engineer B, was contacted through a legitimate job-hunting platform by a person posing as a project director. Engineer B's profile on the platform referenced his experience at Binance, Binance said. A first-round interview followed with a purported human resources representative, conducted by live video, in which the interviewer shared a social media account, including personal photos and videos, to build trust. A second-round interview, held in a popular social chat app with a person claiming to be the chief executive of a fictitious company, ended with an instruction to download an "assignment" containing a malicious code repository onto his work computer. The repository contained malicious code that executed during setup, Binance said, replacing a legitimate pyenv development tool component with a malicious version, opening a channel to an attacker-controlled server, and evading endpoint security tools at the time. The malware was a zero-day, Binance said, meaning it was previously undetected by those tools, and the attacker took steps to conceal the activity and remove traces.

The October 20 pivot and the October 29 drain

On October 20, 2026, Binance said, the attacker used Engineer B's compromised computer and an internal AI tool to gain control over Engineer A and another wallet software engineer, identified as Engineer C. The attacker soon discovered that Engineer A had a container deployment permission token on his computer. On October 29, between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used the credentials stolen from Engineer A, deployed a container, and triggered a malicious script to launch the attack through Binance's internal wallet signing service. The report does not describe a private key leak. It describes unauthorized access to the signing service, which the attacker then used to initiate transactions outside the normal withdrawal process.

The money moved fast once the signing service was reached. Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, Binance said. Hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP to attacker-controlled addresses, and a Binance hot wallet then sent 18,270 BTC to an attacker-controlled address. Binance said it received an internal alert about large-volume transfers and immediately began investigating, then suspended withdrawals and coordinated with partners to freeze affected tokens.

Why stopping withdrawals did not stop the theft

The most consequential technical detail in the report explains why the drain continued after Binance halted withdrawals. The attacker used the signing service to exploit Ethereum's EIP-7702 authorization mechanism, Binance said. EIP-7702 allows an account to delegate certain execution rights to a smart contract without exposing the private key, and in this case the attacker gave an attacker-controlled smart contract partial execution rights over a Binance hot wallet. The attackers submitted 50 signing transactions to manipulate the account nonce and establish malicious delegation authorizations, Binance said, and once established, those authorizations operated independently of Binance's normal withdrawal infrastructure. Suspending withdrawals and shutting down hot wallet services did not automatically invalidate existing on-chain authorizations, Binance said.

Revoking those authorizations took extra time for a structural reason, according to Binance. The hot wallet used multi-party computation, so there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations, and the team had to develop and execute a specialized procedure. The final unauthorized transfer, 2,961.9 ETH, finalized on-chain at 23:56 UTC on October 29, after previously being broadcast and remaining pending, Binance said, and no further unauthorized transfers were observed after that. At 00:10 UTC on October 30, Binance executed a new authorization from the Binance14 hot wallet to the zero address, clearing the EIP-7702 delegation code. Binance said these challenges extended the time required to fully contain the unauthorized movements, and that it is reviewing its incident response process, signing policy coverage, and hot wallet controls.

The $2.85 billion frozen total, and what comes next

On recovery, Binance's headline figures need careful reading, because its own updates have not all used the same number. The November 3 report says about $2.85 billion had been frozen or intercepted and 98 percent of affected token assets had been replenished as of October 31. Unchained noted that Binance's earlier recovery updates gave lower figures, 90 percent on October 31 and about 95 percent on November 2, and those figures are not reconciled in the November 3 report, so they should be treated as separate company-reported statements rather than a single continuous timeline. Separately, co-chief executive Richard Teng shared data on November 3 showing customers withdrew $10.97 billion in the 46 hours after withdrawals reopened, with net outflows of $5.28 billion, according to Bitcoin Magazine, and Teng said hourly deposits exceeded withdrawals by 03:00 UTC, a shift he called a sign of stabilization. Bitcoin Magazine also reported that Binance reopened withdrawals for dozens more assets across nine networks on November 3.

Binance listed the remediation already done as of November 3: it rebuilt the affected wallet system in a new environment, rebuilt the affected internal AI tool and its access controls, replaced affected devices, decommissioned credentials and tokens related to the affected engineers, completed enhanced security scans across all employee devices, enhanced AI-based behavioral anomaly detection, and strengthened wallet-service risk controls, while working with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets. Its next steps, according to the report, are an independent third-party cybersecurity review to validate the findings and recommend further measures, increased investment in AI-enabled detection, endpoint protection, developer-environment security, and behavioral anomaly monitoring, and a security research fund with AI companies, industry participants, and security firms focused on AI security in blockchain environments. On attribution, the report notes the U.S. Federal Bureau of Investigation's finding that North Korea is responsible, while Bitcoin Magazine reported that Binance's report cites that finding but stops short of its own attribution, and North Korea denied the claim on November 2, with Kim Yo Jong calling it a grave political provocation through state media. The breach affected Binance.com, according to the report's coverage, while its U.S.-facing platform said it was not affected. This article is news reporting and is not investment advice.

Sources

• Binance, Initial Findings and Response Update (November 3, 2026, primary source: $6.34 billion impacted, about $2.85 billion frozen or intercepted, 98 percent of affected token assets replenished as of October 31, June tampered Homebrew download, September fake job interview, October 20 internal AI tool pivot, October 29 container deployment and EIP-7702 authorizations, final transfer 2,961.9 ETH at 23:56 UTC, delegation cleared 00:10 UTC October 30)
• Bitcoin Magazine, Binance Says $6.34B Hack Began With Fake Job Interview (November 3, 2026, secondary source: five-month campaign, 50 signing transactions, 57 suspected North Korea-linked attempts blocked in 2026, $10.97 billion withdrawn over 46 hours with $5.28 billion net outflows, dozens more assets reopened across nine networks)
• crypto.news, Binance details fake interview route into $6.34B hack (November 3, 2026, secondary source: fake job interviews, malicious software, and compromised internal AI tool; 233.46 million XRP, 970,500 SOL, 44.2 million OP, and 18,270 BTC moved; multi-party computation wallet required a specialized revocation procedure)
• Unchained, Binance Details Four-Month Path From Tainted Developer Install to $6.34 Billion Drain (November 3, 2026, secondary source: June tampered Homebrew installation, September fake recruiter, October 20 AI tool pivot, October 29 drain, and the unreconciled 90 percent and 95 percent earlier replenishment figures)
• Blockchain.News, Binance details October 29 security incident and response (November 3, 2026, 16:06 UTC, secondary source: preliminary findings, EIP-7702 abuse, about $2.85 billion frozen or intercepted, 98 percent replenished as of October 31, findings described as preliminary)