Hackers spent months infiltrating Binance through fake job interviews, malicious software and compromised internal tools before stealing <\/span>$6.34 billion in cryptocurrency<\/b> from the world\u2019s largest crypto exchange, according to a security report released by the company on Tuesday.<\/span><\/p>\n The <\/span>October 29 attack<\/span><\/a> targeted computers belonging to three software engineers, eventually giving attackers access to systems responsible for authorizing wallet transactions. Binance\u2019s investigation revealed a coordinated operation that began with a compromised software download in June, escalated through a fraudulent recruitment campaign in September and culminated in one of the largest crypto heists on record.<\/span><\/p>\n The incident highlights how cybercriminals are increasingly exploiting employees and trusted workplace tools to penetrate even sophisticated financial platforms.<\/span><\/p>\n According to Binance, the first breach occurred in June when an engineer on its Wallet DevOps team downloaded a tampered version of Homebrew, a popular software package manager, while searching online for an AI coding tool.<\/span><\/p>\n The malicious installer had reportedly been promoted through an online advertisement, allowing it to appear higher in search results than the legitimate software.<\/span><\/p>\n Binance detected the suspicious activity, replaced the affected device and changed the employee\u2019s credentials. However, attackers had already obtained information about the engineer\u2019s role and colleagues responsible for the exchange\u2019s wallet infrastructure.<\/span><\/p>\n In September, hackers targeted a second software engineer through what appeared to be a legitimate recruitment opportunity on a job-search platform.<\/span><\/p>\n The employee participated in a video interview with a supposed human resources representative, followed by another interview through a messaging application with someone claiming to be the chief executive of a fictitious company.<\/span><\/p>\n During the process, the engineer was asked to complete a coding assignment by downloading a repository containing <\/span>hidden malware designed to evade security detection<\/b>. This gave attackers another foothold inside Binance\u2019s systems.<\/span><\/p>\n Binance hackers used fake job interview in $6.3 billion attack<\/span><\/i><\/p>\n The attackers subsequently used the compromised computers to move deeper into Binance\u2019s infrastructure.<\/span><\/p>\n On October 20, they combined access to the infected computer with an internal AI tool to gain control of the systems of two wallet developers.<\/span><\/p>\n Nine days later, hackers used the second developer\u2019s compromised computer, alongside credentials stolen from the first engineer, to deploy a malicious script and initiate the attack.<\/span><\/p>\n Binance co-CEO Richard Teng said the breach was the result of a months-long operation rather than a single security failure involving one employee.<\/span><\/p>\n Speaking to CNBC, Teng explained that attackers first compromised an engineer through a tampered developer tool before using a fake recruitment process to target another employee. They then exploited internal AI tools to reach systems responsible for authorizing wallet transactions.<\/span><\/p>\n The incident also raises questions about the security risks associated with AI adoption in corporate environments. While internal AI applications can improve productivity, compromised employee accounts may turn these tools into pathways to sensitive infrastructure.<\/span><\/p>\n The final stage of the operation unfolded on October 29, when attackers exploited unauthorized access to Binance\u2019s wallet transaction-signing system.<\/span><\/p>\n According to the report, hackers transferred <\/span>233.46 million XRP from five Binance hot wallets within approximately four minutes<\/b>, sending the cryptocurrency to an address under their control. They subsequently withdrew other digital assets, including Bitcoin and Solana.<\/span><\/p>\n Binance received an internal alert about unusually large transfers and began investigating. The exchange suspended withdrawals, froze affected assets and worked to revoke unauthorized permissions.<\/span><\/p>\n However, these measures did not immediately stop the attack.<\/span><\/p>\n Binance said hackers used 50 signing transactions to manipulate account authorizations through Ethereum\u2019s EIP-7702 mechanism, which allows accounts to delegate certain execution rights to smart contracts.<\/span><\/p>\n Because the malicious authorizations operated independently of Binance\u2019s normal withdrawal infrastructure, suspending withdrawals alone was insufficient to prevent further transfers.<\/span><\/p>\n The exchange had to develop additional procedures to revoke the permissions. According to its report, the <\/span>final unauthorized transfer occurred at 23:56 UTC<\/b>, nearly four hours after the initial theft began.<\/span><\/p>\n Binance said approximately <\/span>$2.85 billion of the stolen assets had been frozen or intercepted<\/b>, with assistance from law enforcement agencies and industry partners.<\/span><\/p>\n The exchange also pledged to cover all customer losses using its own resources rather than passing the financial impact on to users.<\/span><\/p>\n As of October 31, Binance had replenished approximately <\/span>98% of the affected assets<\/b><\/a>, Teng said. The remaining portion consists of less liquid cryptocurrencies that the company is still working to acquire.<\/span><\/p>\n The exchange has rebuilt the affected wallet infrastructure and internal AI tool, replaced compromised devices, revoked credentials associated with the targeted engineers and expanded security monitoring across employee devices.<\/span><\/p>\n Binance is also increasing investment in AI-powered threat detection, commissioning an independent cybersecurity review and developing a security research fund to strengthen its defenses.<\/span><\/p>\n \u201cThis should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,\u201d Binance said in its report.<\/span><\/p>\nFake software and job interviews opened the door<\/b><\/h2>\n
![\"Binance](\"https:\/\/nftplazas.com\/wp-content\/uploads\/2026\/11\/2-2-1024x576.png\")
<\/p>\nInternal AI tools helped expand access<\/b><\/h2>\n
$6.34 billion stolen in a matter of minutes<\/b><\/h2>\n
Binance replenishes 98% of affected assets<\/b><\/h2>\n
North Korea attribution remains disputed<\/b><\/h2>\n