Binance Says $6.3 Billion Hack Traced to Fake Job Interview, Months of Infiltration

Binance has disclosed that the theft of roughly $6.3 billion in digital assets from its hot wallets on Oct. 29 was the product of a months-long infiltration campaign that began with a poisoned software package in June and widened through a fake job interview in September, according to the exchange's initial incident report published Nov. 3.

The disclosure, delivered at a media briefing in Hong Kong, marks the first detailed account of what may be the largest cryptocurrency heist on record. Binance co-CEO Richard Teng told reporters the operation "was a campaign, built over many months," and the FBI has attributed the theft to North Korea. Pyongyang has rejected the accusation.

Binance said $2.85 billion of the stolen assets had been frozen or intercepted as of the report's publication, and that it has replenished roughly 95% to 98% of affected tokens using company resources. The exchange said customers will not bear any financial loss.

How the breach unfolded

Binance chief security officer Jimmy Su walked reporters through a sequence that began in June 2026, when a wallet engineer downloaded a tampered version of the Homebrew package manager while searching for an AI tool. The exchange detected the compromise and replaced the device, but Su said the engineer and colleagues on the wallet team remained exposed.

In September, a second software engineer who was job-hunting was contacted on a legitimate recruitment platform by someone posing as a project director. A supposed HR representative conducted a video interview and shared a social media account with personal photos to build credibility. A follow-up call with a purported chief executive ended with the engineer being asked to download a coding assignment onto his work computer. The file carried previously undetected zero-day malware that evaded endpoint security.

On Oct. 20, the attackers used that compromised machine together with an internal AI tool to reach the computers of two engineers responsible for wallets. Nine days later they used stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC on Oct. 29.

According to the report, the attackers drained XRP, SOL, OP, Bitcoin and Ether from hot wallets and exploited an Ethereum feature known as EIP-7702 to grant a malicious smart contract execution rights over a Binance wallet. Because the hot wallets rely on multiparty computation, no single private key could revoke the authorization, and containment ran until 00:10 UTC on Oct. 30. The final unauthorized Ether transfer confirmed on-chain at 23:56 UTC.

Binance said it has rebuilt the affected wallet systems and internal AI tools, replaced equipment, revoked credentials and access tokens for affected staff, and tightened risk controls and AI-based anomaly detection. It will bring in an independent cybersecurity firm for a full review and plans to expand AI security spending, establish a research fund and pursue industry partnerships.

Note: Replenishment and outflow figures reflect different reporting dates between Nov. 1 and Nov. 3.

Withdrawals normalize as finances hold

Speaking at Hong Kong Fintech Week, Teng said hourly deposits and withdrawals have largely returned to normal and described the company's balance sheet as "very strong." Losses were covered through the Secure Asset Fund for Users, or SAFU, a portion of the futures insurance fund and corporate treasury, he said. The remaining 5% of affected assets consists mainly of less-liquid tokens being sourced through market and over-the-counter channels. Binance said it had set aside more than 100% of the stolen amount.

Customers pulled a net $4.72 billion from the platform after withdrawals resumed on Nov. 1, equal to roughly 3% of the $171 billion in assets reported in its latest proof-of-reserves snapshot. Most of the outflow was in Tether's USDT stablecoin. The exchange has since expanded withdrawal access in phases and launched a customer campaign through Nov. 21 offering fee rebates and volume-based rewards.

On Nov. 2, Binance completed zero-knowledge proof verification for its Oct. 31 reserve snapshot covering 10 major tokens including Bitcoin, Ether, USDT, BNB, Solana and USDC, allowing users to confirm balances were backed at a minimum one-to-one ratio. A further snapshot covering additional tokens was scheduled for Nov. 4. The exchange cautioned that replenishing customer assets is separate from recovering the stolen funds themselves.

Binance co-founder Changpeng Zhao, who stepped down as chief executive in 2023, said in an interview with Yahoo Finance that artificial intelligence is making attacks easier and that "there's no 100% security." He said all user funds are covered and that the platform absorbed the losses.

Attribution fight and market fallout

The FBI attributed the theft to North Korea's TraderTraitor group on Oct. 31, saying stolen assets were being converted primarily into Ether before potential movement through decentralized finance protocols and instant-swap services. The bureau, alongside the Secret Service and IRS Criminal Investigation, urged exchanges and blockchain operators to block addresses tied to the proceeds. North Korea's Kim Yo Jong dismissed the allegation as "absurd rhetoric," according to the state-run KCNA news agency.

Blockchain analytics firm Elliptic estimates that $3.28 billion remains under the attackers' control, mostly in Bitcoin and Ether, and that laundering could take months given the difficulty of moving billions without detection. Circle said it had frozen more than $1.1 billion in USDC linked to the incident, while Arbitrum's Security Council moved 8,425 ETH and 74.6 million ARB into a holding address pending a governance vote.

Market reaction has been contained but visible. Bitcoin traded above $81,000 on Oct. 28 before sliding to $76,900 by Nov. 3, while Ether, XRP and Solana also fell in the days after the breach. U.S. spot Bitcoin ETFs recorded $643 million in net outflows on Oct. 30, the heaviest single day of the month, and more than $1.3 billion in leveraged positions were liquidated.

Maksym Repa, head of DeFi at Lombard, said investors appear to be distinguishing a security failure at a centralized exchange from the integrity of the Bitcoin network itself, a separation that has limited contagion. Tim Sun, a senior researcher at HashKey Group, said the withdrawals have not reached the scale of a broad run on the platform.

For the industry, the episode sharpens questions how exchanges authorize transactions and how much authority sits around a signing key rather than in its storage. Binance said it blocked 57 suspected North Korea-linked attempts this year and has promised a detailed technical post-mortem. The immediate test is whether it can complete the remaining token purchases and restore unrestricted withdrawals, with the Nov. 4 reserve snapshot and the final incident report offering firmer evidence than the stabilization in deposit flows alone.