Binance says fake job interview led to $6.34 billion crypto security breach

Binance has revealed that hackers used fraudulent job interviews, malicious software downloads and an internal artificial intelligence (AI) tool to compromise employee devices and gain access to its wallet infrastructure in a security breach involving approximately $6.34 billion in digital assets.

In an initial incident report released on Tuesday, the cryptocurrency exchange detailed a multi-stage cyberattack that began in June 2026 and culminated in unauthorised transactions on October 29. The incident has raised fresh concerns about the use of social engineering and compromised developer tools to target employees with access to sensitive financial systems.

According to Binance, the attackers initially compromised a Wallet DevOps employee's computer in June after the employee downloaded a tampered version of a popular developer tool while searching for an AI coding application online.

Although Binance detected the suspicious activity, replaced the device and rotated the associated credentials, the attackers had already gained information about the employee's role and colleagues working on its wallet infrastructure.

The campaign escalated in September when another software engineer, who was exploring new employment opportunities, was approached through a legitimate job-hunting platform by someone posing as a project director at a fictitious company.

The engineer participated in two virtual interviews, including one with an individual claiming to be the company's chief executive. Towards the end of the process, the candidate was asked to download a coding assignment containing a malicious repository onto their work computer.

Binance said the malware exploited development tools to execute unauthorised commands and communicate with an external server controlled by the attackers. Its endpoint security systems did not detect the malware at the time.

On October 20, the attacker used the compromised engineer's computer, together with access to Binance's internal AI tool, to gain control over the systems of two other wallet developers. The attackers subsequently obtained a deployment permission token and used stolen credentials to access wallet operations.

Theft unfolded across multiple cryptocurrencies

The attack took place on October 29, when five Binance internet-connected hot wallets transferred 233.46 million XRP to an attacker-controlled address within four minutes, between 20:05 and 20:09 UTC.

The attackers subsequently moved approximately 970,500 Solana (SOL), 44.2 million Optimism (OP) tokens and 18,270 Bitcoin (BTC), among other digital assets. They also exploited Ethereum's EIP-7702 authorisation mechanism to grant an attacker-controlled smart contract execution permissions over a Binance hot wallet.

Binance received an internal alert about unusually large transfers and initiated containment measures, including suspending withdrawals, coordinating with industry partners to freeze affected tokens and revoking unauthorised permissions.

However, the attackers continued moving assets because the malicious on-chain authorisations operated independently of the exchange's normal withdrawal infrastructure. Binance said the attackers submitted 50 signing transactions to establish these authorisations, complicating the process of revoking them.

The final unauthorised transfer was completed at 23:56 UTC on October 29, nearly four hours after the first transfers. Binance said approximately $2.85 billion in digital assets had been frozen or intercepted, subject to reconciliation and market price fluctuations.

Binance to strengthen AI-enabled security

The Federal Bureau of Investigation (FBI) has attributed the incident to North Korea, a claim rejected by Pyongyang.

Binance said it would absorb the financial impact of the incident rather than pass the losses on to customers. 

As of October 31, the exchange had replenished 98 per cent of the affected token assets and set aside more than 100 per cent of the funds required to cover the losses.

The company has since rebuilt the affected wallet systems and internal AI tool, replaced compromised devices, revoked credentials and tokens associated with affected employees, and strengthened wallet-service controls.

It is also expanding investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring. The exchange plans to establish a security research fund and launch targeted initiatives with leading AI companies, cybersecurity firms and industry participants to address emerging threats in blockchain environments.

Binance said its security team had detected and prevented 57 suspected North Korea-linked cyberthreats during 2026, highlighting the scale of cyberattacks targeting the cryptocurrency industry.

The exchange is also engaging independent cybersecurity firms to review the incident and validate its findings, while continuing to work with law enforcement agencies, blockchain intelligence firms and industry partners to trace and freeze the stolen assets.