# Binance says attackers behind its $6.34 billion heist used fake job interviews and an internal AI tool

> Binance’s initial report says the attack began in June. The AI tool helped attackers move between engineers; it was not the system that signed transactions.

- Publisher: JARRUS (@jarrus.tech), thejarrus.com
- Story date: Nov. 3, 2026 (2026-11-03)
- Published: 2026-11-07
- Tags: Safety and security, Companies and people
- URL: https://thejarrus.com/en/news/binance-heist/

### Binance's initial incident report

On Nov. 3, Binance published its initial incident report on the Oct. 29 attack as an article on its own X account. According to the report, it was not a single isolated breach or a simple phishing incident. The attackers combined social engineering through fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorization method.

Binance calls the document an initial report: the investigation is ongoing, the findings will be subject to further independent review and some technical details will remain confidential. Co-CEO Richard Teng wrote on X the same day that this was not one mistake or one breach but a months-long campaign. In a live interview on CNBC, Teng also described the fake developer tool in June and the fake job interviews in September, and said an independent expert would review everything the company has done.

https://x.com/_RichardTeng/status/2117626871445921884

### June: a tampered Homebrew installation

The first step in the report is a supply-chain attack. A Wallet DevOps engineer on Binance's wallet infrastructure team ("Engineer A" in the report) downloaded a tampered Homebrew installation found through a search engine while trying to install a popular AI coding tool. Homebrew is a widely used package manager for installing software on macOS. The security team spotted the anomaly, replaced the device and rotated credentials. According to the report, the engineer's role and colleagues on the wallet infrastructure team were nonetheless exposed to the attacker.

Binance doesn't name the coding tool. At this step the report links to an April 30 write-up by the SANS Internet Storm Center about an infostealer spread through a fake Homebrew ad, without saying it was the same campaign. The company also says its security team detected and blocked 57 suspected North Korea-linked cyber threat cases in 2026. They involved fraudulent job interviews, malware disguised as popular developer tools, compromised software packages and browser extensions, and fake video-conferencing apps.

### September: a fake interview and a malicious "assignment"

In September, someone posing as a project director, with Binance experience listed on their profile, approached another software engineer ("Engineer B") through a legitimate job-hunting platform. The first round was a live video call with a fake HR representative. To build trust, the attackers shared a social media account with personal photos and videos; Binance describes the setup as more advanced and deceptive than previously seen. The second round took place with the fake company's "CEO" on a popular social chat app, and ended with the engineer being asked to download an "assignment" to a work computer.

The code ran during installation and replaced a legitimate development tool component with a malicious version. The report walks through the steps using pyenv, the Python version manager: the real pyenv file in the Homebrew directory was deleted and a fake one was put in its place under the same name. According to the report, endpoint security tools didn't detect this zero-day malware at the time, and the attacker also wiped traces.

### Oct. 20: the internal AI tool

From Engineer B's compromised computer, the attacker used an internal AI tool as a springboard to gain control over the computers of Engineer A and another wallet software engineer ("Engineer C"). The attacker then found a container deployment permission token on Engineer A's computer.

Binance hasn't disclosed the tool's name, maker or type, or how control was gained through it. According to the report, the tool helped the attacker move between engineers; it was not the system that approved or signed the transactions. The company rebuilt the affected tool and its access controls.

On Nov. 4, co-CEO Yi He wrote that many professionals had advised against including details in the report, but that the company believes transparency creates trust. According to Yi He, if the report is of reference value to peers on the complexity of social engineering and the warning about AI permission boundaries, then it is meaningful. Binance has restructured security boundaries across departmental access management, security environments and devices, and reset its AI tools, following zero-trust and least-privilege principles. Yi He added that a security audit will later issue its own report.

https://x.com/heyibinance/status/2117951579588595963

### Oct. 29: the signing service and EIP-7702

According to the report, between 17:15 and 19:56 on Oct. 29 (the report doesn't give a time zone) the attacker logged onto Engineer C's computer, used credentials stolen from Engineer A to deploy a container, and triggered the malicious script that launched the attack. That gave the attacker unauthorized access to an internal wallet signing service and the ability to initiate transactions outside the normal withdrawal process.

The first transfer left at 8:05 p.m. UTC, on XRP: five hot wallets sent 233.46 million XRP within about four minutes. About 970,500 SOL and 44.2 million OP left on Solana and Optimism, and the Bitcoin hot wallet sent 18,270 BTC. On Ethereum, the attackers submitted 50 signing transactions through the signing service to manipulate the account nonce and establish malicious EIP-7702 delegation authorizations. EIP-7702 is the mechanism that lets an ordinary Ethereum account delegate its execution rights to a smart contract.

Binance says halting withdrawals wasn't enough, because those authorizations were already on-chain. Since the wallets are protected with MPC (multi-party computation) and have no single private key, revoking them required a special procedure. The last unauthorized transfer, 2,961.9 ETH, went out at 11:56 p.m. UTC. At 12:10 a.m. UTC on Oct. 30, the affected wallet's delegation was cleared by pointing it to the zero address.

Blockchain analytics firms describe the same picture. According to TRM Labs, the 50 authorizations were submitted in a single transaction; 3 minutes and 24 seconds later the wallet sent its entire balance, 63 tokens including 167,464 ETH and 1.615 billion USDT. Elliptic says $2.53 billion of the Ethereum losses left in a single transaction. TRM says preparation began at least 36 hours before the theft: the attacker's operator wallet received small withdrawals from Tornado Cash from the morning of Oct. 28, the attack code was tested on two wallets on Oct. 29, and the final version was rehearsed on a third.

### The numbers: $6.34 billion, with $2.85 billion frozen

Binance puts the impacted assets at about $6.34 billion. Other estimates vary with the prices used: TRM Labs says $6.36 billion, Chainalysis about $6.4 billion and Elliptic $6.43 billion, while the FBI says more than $6 billion. Binance says about $2.85 billion has been frozen or intercepted together with law enforcement, token issuers and blockchain intelligence firms.

The affected wallets were Binance's own hot wallets. The company says it found no evidence of a private key leak and that users will not bear the loss. On Oct. 30, Binance set aside $6.34 billion of company funds to cover it, drawn from part of its SAFU user protection fund, part of its futures insurance fund and the company treasury. As of Nov. 3-4, the company says about 98% of the affected tokens had been replenished. Withdrawals were halted on Oct. 29 and gradually reopened on Nov. 1.

By Elliptic's count, 82% of the stolen funds were taken on Ethereum and Bitcoin. Some 64% of the funds taken on Ethereum have been frozen, while none of the Bitcoin has.

![Elliptic chart: funds stolen and frozen in the Binance hack by blockchain. On Ethereum, $2,417 million of $3,798 million was frozen, and on Tron $379 million of $627 million; nothing was frozen on Bitcoin, XRP Ledger, Solana or NEAR.](https://thejarrus.com/gorsel/binance-elliptic-zincir-en.webp)
*Chart: [Elliptic, The largest theft in history](https://www.elliptic.co/insights/binance-largest-hack-in-history/) (as of Oct. 31, 2026). Figures in millions of dollars; the percentage in parentheses is the frozen share of the stolen funds.*

### Attribution: the FBI and North Korea's denial

On Oct. 31, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29, and referred to the activity as "TraderTraitor." According to the FBI, the attackers converted the stolen assets mainly into ETH, and the funds are expected to keep being laundered through DeFi and instant-exchange services. The FBI, the U.S. Secret Service and IRS Criminal Investigation asked private-sector firms to block transactions involving addresses linked to the attackers and published the list. Binance cites this FBI information in its report.

Chainalysis and TRM Labs also attribute the attack to TraderTraitor with high confidence. One of Chainalysis' grounds is that funds stolen from Bitget in September were commingled on-chain with the Binance funds at the same address. After the FBI's statement, Elliptic wrote that it had also assessed TraderTraitor as the likely perpetrator.

North Korea rejected the accusation. In a statement made on Nov. 2 and carried by the state news agency KCNA on Nov. 3, Kim Yo Jong, a department director of the Workers' Party Central Committee, called the U.S. assertion "an absurd rhetoric and nothing new" and the renewed link to North Korea "a trite provocation." In a second statement on Nov. 4, Kim Yo Jong said Pyongyang does not regard the incident as an accidental case or an isolated private scheme, but as an extension of Washington's unchanging hostile policy toward North Korea.

The TraderTraitor name and playbook aren't new. According to an April 2022 joint advisory from CISA, the FBI and the U.S. Treasury, these attacks start with messages to system administrators or DevOps staff at crypto companies that mimic a recruitment effort and offer high-paying jobs. The FBI, the Department of Defense Cyber Crime Center and Japan's National Police Agency say that in the $308 million DMM Bitcoin theft in May 2024, an actor posing as a recruiter on LinkedIn sent an employee of Ginco, a Japanese enterprise crypto wallet software company, a malicious Python script disguised as a pre-employment test. On Nov. 3, Chainalysis said it had attributed more than $14.3 million in losses over the past 18 months to similar North Korea-linked fake interview and malware schemes. Binance hasn't tied the incident to a specific named campaign.

https://x.com/FBICyberBranch/status/2116660730745299426

### The largest crypto heist on record

According to Elliptic, the Binance theft is 4.4 times the size of the previous record, the $1.46 billion Bybit hack of February 2025, which the FBI also attributed to TraderTraitor. Four of the ten largest crypto heists on Elliptic's list have been linked to North Korea by the FBI. Chainalysis says North Korea-linked hackers stole at least $2.02 billion in crypto in 2025, bringing their all-time total to at least $6.75 billion; the roughly $6.4 billion moved in the Binance hack alone equals 95% of that total.

![Elliptic chart: the largest crypto heists. Binance leads with $6,431 million, followed by Bybit at $1,460 million; the 2003 Central Bank of Iraq theft ($1,000 million) is shown for comparison.](https://thejarrus.com/gorsel/binance-elliptic-en-buyuk-en.webp)
*Chart: [Elliptic, The largest theft in history](https://www.elliptic.co/insights/binance-largest-hack-in-history/) (as of Nov. 1, 2026). Figures in millions of dollars; colored bars are heists the FBI has attributed to North Korea.*

Binance founder Changpeng Zhao (CZ) wrote on Nov. 4, as a shareholder, that a hack of this scale means serious security failures occurred, and that no platform is unhackable but that cannot be an excuse. According to CZ, public explanations simplify what appears to have been a prolonged attack lasting months or even years, targeting hundreds of employees and systems, with a few ultimately compromised. The report gives no figures on that scope.

https://x.com/cz_binance/status/2117846768666755491

Binance has brought in independent cybersecurity firms to review the incident; a final report on the root cause hasn't been published yet. In the report, the company also committed to investing in AI security, setting up a security research fund and launching targeted initiatives with leading AI companies.

### No mention of the fake Claude Code extension

The attack fell on the same day a tampered version of the Claude Code extension was distributed on Cursor's extension marketplace, and people on X asked whether the two were connected. Binance's report doesn't mention the extension; Claude Code, Cursor and Anthropic don't appear in it. The attack chain it describes began weeks before the malicious versions 2.1.312 and 2.1.313 were on the marketplace between 9:27 a.m. and 8:35 p.m. UTC on Oct. 29: the entry came through the fake interview assignment in September, and the move through the AI tool and the discovery of the container token happened on Oct. 20.

If the Oct. 29 session, for which the report gives no time zone, was in UTC, it overlaps with the hours the extension was live, but Binance attributes that session to credentials stolen earlier from Engineer A. The June step wasn't an extension either, but a tampered Homebrew installation.

*Cover image generated with AI.*

## Sources

1. [Binance (X): 29 October Binance Security Incident: Initial Findings and Response Update, Nov. 3, 2026](https://x.com/binance/status/2117626126214504729)
2. [Richard Teng (X): Teng’s statement alongside the report: $6.34B, 98%, $2.85B frozen, Nov. 3, 2026](https://x.com/_RichardTeng/status/2117626871445921884)
3. [Binance (X): First statement: a compromised DevOps engineer’s laptop, no evidence of a private key leak, about $6.3B, Oct. 30, 2026](https://x.com/binance/status/2115993361517891592)
4. [Yi He (X): Binance’s co-CEO on the report’s warning about AI permission boundaries, resetting AI tools, zero-trust and least-privilege principles, Nov. 4, 2026](https://x.com/heyibinance/status/2117951579588595963)
5. [FBI Cyber Branch (X): The X announcement of the FBI alert (TraderTraitor), Oct. 31, 2026](https://x.com/FBICyberBranch/status/2116660730745299426)
6. [FBI: North Korea Responsible for $6 Billion+ Binance Attack, Oct. 31, 2026](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack)
7. [KCNA: Press Statement of Kim Yo Jong, Department Director of C.C., WPK, Nov. 3, 2026](http://www.kcna.kp/en/article/detail/873496f71f6ab3e667a4271b5a4cf4c6)
8. [Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link, Oct. 30, 2026](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/)
9. [Chainalysis: DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance, Nov. 3, 2026](https://www.chainalysis.com/blog/binance-hack-dprk-employment-fraud/)
10. [TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, Oct. 29, 2026](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history)
11. [Elliptic: The largest theft in history: North Korea behind the $6.4 billion Binance hack, Oct. 30, 2026](https://www.elliptic.co/insights/binance-largest-hack-in-history/)
12. [CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto, Nov. 3, 2026](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html)
13. [Changpeng Zhao (X): A hack of this scale means serious security failures occurred., Nov. 4, 2026](https://x.com/cz_binance/status/2117846768666755491)
14. [Chainalysis (X): North Korean hackers stole at least $2.02B in crypto in all of 2025, bringing their all-time total to at least $6.75B., Nov. 3, 2026](https://x.com/chainalysis/status/2117668711494562250)
15. [KCNA: Press Statement of Kim Yo Jong, Department Director of C.C., WPK, Nov. 4, 2026](http://www.kcna.kp/en/article/detail/547d4372853b197db4d1c73810d70768)
16. [SANS Internet Storm Center: Malicious Ad for Homebrew Leads to MacSync Stealer, April 30, 2026](https://isc.sans.edu/diary/32942)
17. [CISA: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, April 18, 2022](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a)
18. [FBI: FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com, Dec. 23, 2024](https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom)
19. [FBI (IC3): North Korea Responsible for $1.5 Billion Bybit Hack, Feb. 26, 2025](https://www.ic3.gov/PSA/2025/PSA250226)

Report an error: corrections@thejarrus.com