Binance blames fake job interview and internal AI tool for $6.3 billion breach

Binance published an initial incident report on Tuesday attributing the theft of more than $6.3 billion in crypto to a months-long intrusion that began with social engineering and ended with a malicious script run against its wallet-signing infrastructure, according to The Block, which reviewed the report.

Per the report, the attackers first targeted a Wallet DevOps engineer in June through a tampered Homebrew installation the engineer downloaded while trying to install an AI coding tool. Binance says its security team caught the anomaly, swapped the device and rotated credentials — but the episode exposed details about the engineer's role and colleagues. In September, a second employee was compromised through a fake recruitment process: attackers posing as company executives got him to download a malicious "coding assignment" that infected his work computer. On Oct. 20, Binance says, the attackers used that machine and an internal AI tool to take over two more engineers' devices, finding a container-deployment permission on one. Nine days later they used stolen credentials to deploy a container and run the script that launched the wallet attack.

Binance says it has since frozen or intercepted about $2.85 billion and replenished 98% of impacted assets. Co-CEO Richard Teng wrote on X that "this wasn't one mistake or one breach — it was a months-long campaign," adding that "the speed of coordination could not be matched in traditional finance." Binance says the FBI linked the attack to North Korea; its own investigation pointed to the same actors. On Monday, Kim Jong-un's sister called the FBI's attribution a "grave political provocation."

Key facts

• Theft of more than $6.3 billion (report cites $6.34 billion); initial incident report published Tuesday, Nov. 3 (The Block).
• About $2.85 billion frozen or intercepted; 98% of impacted assets replenished (Binance's figures, via The Block).
• Entry via fake job interview and tampered Homebrew/AI-tool download; wallet attack executed Oct. 29 after an Oct. 20 escalation (Binance report).
• FBI attributed the attack to North Korea; Binance says it blocked 57 suspected North Korea-linked threats in 2026 (Binance report).
• Withdrawals reopening in phases from 4 a.m. UTC Nov. 3 across BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, TRON and Base (Binance).

The real-world read

Nearly every figure here — the $2.85 billion recovered, the 98% replenishment, the "57 threats" count, the tidy attack timeline — comes from Binance's own account of its own breach, and has not been independently verified. The genuinely external data point is the FBI's North Korea attribution. The promised independent cybersecurity review is being commissioned, not completed, so the self-reported narrative is all that exists for now. Note the irony Binance soft-pedals: an internal AI tool was part of the attack path, and the fix it touts is more AI — "expanded AI-based behavioral anomaly detection." Teng's line about out-pacing "traditional finance," and the exchange's own claim that hourly deposits now exceed withdrawals, are reassurance aimed at jittery users, not audited facts.

Opinion, and whose

Teng (Binance co-CEO) frames the breach as an unmatchable coordinated campaign and the recovery as faster than TradFi could manage — an interested party's characterization. North Korea, via Kim Yo-jong, rejects the attribution outright. No neutral third party has yet signed off on either account.

Sources

• The Block (Tier 2, secondary), Nov. 3, 2026 — reported on and quoted Binance's initial incident report, Teng's X posts, the FBI attribution, the recovery figures and the withdrawal reopening. The Block's underlying primary source is Binance's own incident report, an interested party describing its own breach; treat its figures as self-reported pending the independent review Binance says it has commissioned.

Not financial advice.