Binance Reveals How Fake Job Interviews and AI Tools Enabled $6.34 Billion Cyberattack

The world's largest cryptocurrency exchange, Binance, has revealed how cybercriminals used fake job interviews, malicious software and an internal artificial intelligence tool to compromise its systems in an attack involving approximately $6.34 billion in digital assets.

In an incident report released on November 3, 2026, the company disclosed that the attack was not a single security breach but a carefully coordinated operation that developed over several months.

The attackers reportedly began targeting Binance employees in June, using compromised software and recruitment scams to gain access to computers belonging to members of the company's wallet development team.

According to Binance, the first stage involved a developer who unknowingly downloaded a tampered version of Homebrew while attempting to install an AI coding tool. Homebrew is a software package management system commonly used by developers.

Although Binance detected suspicious activity, replaced the affected device and changed related credentials, information about the employee's role and colleagues had already been exposed.

The attackers subsequently identified another employee and approached the individual through a legitimate job-search platform.

In September, the employee was contacted by someone pretending to represent a company seeking to recruit technical professionals. The recruitment process included video interviews and a coding assignment.

However, the assignment contained malicious code designed to compromise the employee's computer.

Once the code was executed, the attackers gained access to the employee's work environment, creating another opportunity to infiltrate Binance's internal infrastructure.

The situation escalated on October 20, when the attackers reportedly used the compromised computer alongside an internal AI tool to gain access to the systems of two additional engineers responsible for cryptocurrency wallet infrastructure.

Nine days later, the attackers used stolen credentials and compromised devices to deploy malicious code targeting Binance's wallet-signing systems.

The operation eventually resulted in the unauthorised movement of cryptocurrency from the exchange's hot wallets.

Binance reported that approximately 233.46 million XRP was transferred from five hot wallets within four minutes. Other affected digital assets included Solana, Optimism, Bitcoin and several additional cryptocurrencies.

The scale of the incident has raised concerns about the security of cryptocurrency exchanges, particularly the systems responsible for authorising transactions and protecting customers' digital assets.

Unlike traditional bank transfers, cryptocurrency transactions recorded on public blockchains are generally difficult or impossible to reverse once completed.

Binance said approximately $2.85 billion of the affected assets had been frozen or intercepted through coordinated efforts involving industry partners and other organisations.

The company also said it would absorb the financial impact of the incident rather than transfer the losses to customers.

The Federal Bureau of Investigation (FBI) attributed the attack to North Korea-linked cybercriminals associated with a group known as TraderTraitor.

The group has previously been linked to cryptocurrency theft operations, with investigations identifying North Korea's cyber activities as a source of illicit foreign currency.

However, Pyongyang has rejected the allegations. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, dismissed the FBI's attribution as politically motivated, describing it as an attempt to damage the country's international reputation.

North Korea has repeatedly denied involvement in major cyberattacks attributed to its hackers.

Beyond the immediate financial losses, the Binance incident has highlighted the growing sophistication of social engineering attacks.

Social engineering involves manipulating individuals into revealing sensitive information, downloading malicious software or granting access to protected systems.

In this case, the attackers reportedly exploited an activity that many professionals consider routine: applying for a job.

The incident also raises questions about the growing use of artificial intelligence in cybersecurity.

Although AI tools can help developers write code, identify threats and automate technical processes, compromised access to internal AI systems can create additional security risks.

Binance has since announced plans to strengthen its security infrastructure, improve device controls and expand AI-powered monitoring to identify suspicious behaviour.

The company also plans to commission an independent cybersecurity review to examine the incident and identify additional weaknesses.