Binance says $6.3B hack started with fake job interviews and a compromised AI coding tool

Binance’s latest postmortem says the largest crypto theft in history was not a single break-in, but a months-long intrusion that blended recruiter-style social engineering with access gained through an internal AI tool. For exchanges, the uncomfortable part is not just the size of the loss; it is how ordinary employee workflows became the entry point into wallet infrastructure.

1. According to Binance, the attack campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool. Binance detected the malware and replaced the affected device, but the attackers had already collected information about the exchange’s wallet team.
2. In September, attackers posing as recruiters targeted another software engineer and sent a malicious file disguised as a coding assignment. That malware compromised the engineer’s work computer and bypassed Binance’s security protections. On Oct. 20, the attackers used that compromised computer and an internal AI tool to reach two additional engineers’ systems and obtain deployment credentials.
3. Binance said those credentials let the attackers install malicious software inside its wallet infrastructure on Oct. 29 and access the exchange’s internal wallet-signing service, which authorizes cryptocurrency transactions. That access allowed funds to move outside the normal withdrawal process.
4. The exchange said the attackers also used Ethereum’s EIP-7702 mechanism, which allows wallets to delegate transaction permissions to smart contracts, to keep unauthorized transfers going even after Binance suspended withdrawals. Binance’s multiparty computation (MPC) wallet system, which distributes control over transaction signing, made it harder to revoke those permissions.
5. The breach affected approximately $6.3 billion in digital assets. Binance said $2.85 billion had been frozen or intercepted, that it would absorb the losses rather than pass them on to customers, and that it had replenished 98% of the affected token assets as of Oct. 31. The Federal Bureau of Investigation (FBI) has attributed the attack to North Korean hackers; on Tuesday, Kim Yo Jong denied North Korea’s involvement.