Binance Says Hackers Used a Fake Job Interview and Its Own Internal AI Tool to Reach the System That Signs Wallet Transactions

The lesson Binance draws from its own postmortem is that the attackers did not need one catastrophic mistake. They needed patience and an internal AI tool that could reach further than the engineer it was compromised through. In a security report published on November 3, Binance said the attackers behind the October 29 theft used a fake job interview and its own internal AI tool to reach the system that authorizes its wallet transactions, The Verge and CNBC reported.

How Binance says the attackers got in#

The preparation began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installer "to install a popular AI coding tool after searching for it on a search engine," CNBC reported, quoting the report. Binance said it spotted suspicious activity and replaced the engineer's device, but by then the engineer's role and colleagues on the wallet infrastructure team had been exposed to the attackers.

In September, the attackers posed as recruiters and ran a series of interviews with another engineer that ended in a coding exercise containing hidden malware, co-CEO Richard Teng told CNBC. On October 20, according to The Hacker News, the attackers used that engineer's machine and the internal AI tool to take control of the access of two more engineers on the wallet team. Stolen credentials and a container-deployment token then let a malicious script reach the wallet-signing service and authorize the transfers on October 29, The Hacker News reported.

"From there they moved violently through our internal AI tools," Teng told CNBC, rejecting the idea that one employee's laptop was a single point of failure.

Where it stands#

Teng said Binance has replenished 98% of $6.34 billion in affected assets and is still buying back some less liquid tokens. He said Binance has rebuilt the affected wallet system and the internal AI tool, replaced compromised devices, revoked the affected engineers' credentials and tokens, and brought in an independent expert to review its response. Teng did not himself attribute the attack, but acknowledged that the FBI has linked it to North Korean hackers tied to the TraderTraitor group, CNBC reported. Industry partners including Tether, Circle and Ripple have reportedly frozen about $3 billion in assets, CNBC said.

Microsoft said last week that it rates AI adoption across North Korean hacking groups as high. Blockchain-analytics firm Chainalysis has said its own recent breach was unrelated to the Binance theft.

Limits#

• We have not read Binance's report directly; this account relies on The Verge, The Hacker News and CNBC, and on Teng's interview.
• Outlets give different totals: The Verge and CNBC's headline use $6.3 billion, Teng gave CNBC $6.34 billion, and The Hacker News uses $6.43 billion.
• The reports do not say what the internal AI tool does or exactly how it was used to take over the other engineers' access.
• The North Korea attribution is the FBI's; Binance's co-CEO did not make it himself.

Sources#

• The Verge: Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist (November 3, 2026)
• The Hacker News: Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft (November 3, 2026)
• CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto (November 3, 2026)