Binance Says Hackers Used Fake Job Interviews and Internal AI Tools to Drain $6.34 Billion in Digital Assets

Binance has published preliminary findings on a major cyberattack that it says hit its cryptocurrency wallet management system through social engineering, malware, and internal AI tools. For high-risk payment and custody operations, the useful part is not the drama; it is the sequence: device compromise, credential theft, internal access, and then unauthorized signing.

1. According to Binance, the attackers began working on the company months before the theft. In June, an employee from the Wallet DevOps team downloaded a modified version of Homebrew to install a popular AI coding tool. Binance’s security system detected an anomaly, the company replaced the device, and associated credentials were updated. By then, the attackers had already obtained information about the engineer’s role and colleagues working on wallet infrastructure.
2. The campaign then shifted into social engineering. Binance says one of the main intrusion methods was a fake recruitment process. In September 2026, someone posing as a project manager contacted one of the company’s engineers. After an initial video interview with a supposed HR representative, the employee attended a second interview with someone impersonating the CEO of a fictitious company.
3. During that second interview, the engineer was asked to download a coding assignment as a software repository onto a work computer. When the repository was configured, malware executed, replaced the pyenv development tool, and connected to an attacker-controlled server. Binance says the malware used concealment and evasion techniques that prevented its security systems from detecting the infection at the moment it happened.
4. On October 20, the attackers used the previously compromised computer and Binance’s internal AI tool to gain control of 2 additional engineers’ devices. They also found a token on one of those devices that granted permission to deploy containers. Immediately before the hack, between 17:15 and 19:56 UTC on October 29, the attackers connected to an engineer’s computer, used stolen credentials to deploy a container, and executed a malicious script.
5. Once inside the internal transaction signing service, the attackers initiated transfers that bypassed the standard withdrawal process. Binance says 233.46 million XRP was moved from 5 Binance hot wallets within 4 minutes, between 20:05 and 20:09 UTC. The report also says about 970,500 SOL and 44.2 million OP were transferred from hot wallets, with the incident affecting about $6.34 billion in digital assets.

Binance is the world’s largest cryptocurrency exchange by trading volume, which makes this case relevant far beyond one venue. If your setup depends on internal signing, wallet ops, employee endpoints, or AI-assisted tooling, the sequence here is the thing to look at: the attackers did not need a single dramatic exploit if they could stitch together social engineering, endpoint compromise, and access to the systems that actually authorize movement.