Binance says attackers used a fake job interview to compromise an employee’s computer before exploiting an internal AI tool to carry out the October 29 cryptocurrency theft of USD 6.3 billion.
Binance's preliminary investigation states the intrusion began in June 2026 when a wallet developer downloaded a modified artificial intelligence (AI) coding tool.
Security staff detected the software, replaced the device and reset credentials. However, attackers had already obtained information about employees and their responsibilities.
In September, another engineer downloaded a malicious code repository after participating in interviews with representatives of a fictitious company, including someone impersonating its chief executive.
Binance says that attackers exploited the compromised computer and an internal AI tool on October 20 to access systems belonging to two wallet developers. Nine days later, they used the second developer's computer and credentials stolen from the first to execute a malicious script initiating unauthorized cryptocurrency transfers.
The company found no evidence that wallet private keys were compromised. “This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance stated.
The exchange reported replenishing approximately USD 6 billion, representing nearly 90% of estimated stolen assets. It also said major cryptocurrencies, including Bitcoin, Ethereum, Tether and BNB, remained fully backed.
“Users will not bear the financial impact of this incident,” Binance previously stated. “Binance will cover all losses.” According to reports, investigators and industry partners have frozen approximately USD 3 billion in potentially affected cryptocurrency.
The FBI attributed the operation to North Korean cyber activity known as TraderTraitor, although North Korea denied involvement. Investigators warned that stolen assets could move through decentralized exchanges and other services to obscure transaction histories.
Binance plans additional AI-powered threat detection, a security research fund, and collaboration with AI companies. The incident highlights how social engineering, compromised developer environments and privileged internal tools can threaten digital asset infrastructure, even without direct private-key theft.
Also Read: North Korea Rejects Allegations of Record USD 6.3 Billion Binance Crypto Hack