Binance said attackers stole more than $6.3 billion in digital assets after using a fake job interview, malware and access to an internal artificial-intelligence tool to penetrate systems connected to its wallet-signing infrastructure.
The exchange said it has frozen or intercepted roughly $2.85 billion of the affected assets and replenished 98% of impacted customer funds. In a Tuesday incident report, Binance described the intrusion as a multi-stage operation that began with targeted social engineering against employees and culminated in unauthorized wallet transactions.
Binance said the FBI attributed the attack to North Korea. Its internal investigation described a campaign combining fraudulent recruitment approaches, malicious developer software, stolen credentials and misuse of internal AI tooling. The reported theft would exceed the $1.5 billion attack on another cryptocurrency service in February 2025, previously regarded as the industry's largest known single incident.
Attackers moved from employee devices to wallet systems
According to Binance, the attackers gained access to systems involved in signing wallet transactions rather than exploiting a public-facing flaw in the exchange's trading platform. Wallet-signing systems authorize the movement of digital assets, making them among the most sensitive parts of a centralized exchange's technical infrastructure.
The company said the initial known target was a Wallet DevOps engineer in June. The employee downloaded a tampered version of Homebrew, a widely used software package manager, while attempting to install an AI coding tool. Binance said its security team identified the anomaly, replaced the device and rotated credentials associated with the machine.
That first episode did not immediately lead to the wallet breach, according to the report. Binance said it gave the attackers information about the engineer's responsibilities and professional connections, helping them refine later targeting efforts.
A second employee was approached in September through a fraudulent recruiting process, Binance said. The attackers allegedly impersonated company executives and sent the employee a malicious coding assignment as part of the supposed interview. Downloading the file infected the employee's work computer and gave the intruders unauthorized access, Binance said.
The operation then expanded rapidly. On Oct. 20, Binance said, the attackers used the compromised computer and an internal AI tool to take control of devices belonging to two additional engineers. They identified container-deployment permissions on one of those systems, creating a route toward production infrastructure.
Nine days later, stolen credentials were used to deploy a container and execute a malicious script that initiated the wallet attack, Binance said. Containers are isolated software environments commonly used to deploy applications and services; in this case, Binance said access to that deployment process became part of the attackers' path to systems capable of initiating asset transfers.
Fake recruitment campaigns targeted technical staff
The report places fake job interviews at the center of the intrusion, underscoring how recruitment scams have become a route into cryptocurrency firms' engineering teams. Developers are routinely asked to review code, run demonstrations or complete technical assignments during legitimate hiring processes, giving attackers a plausible way to distribute malware.
Binance said it detected and blocked 57 suspected North Korea-linked cyber threats during 2026. Many involved fraudulent interview processes and developer-focused tools, according to the company.
The tactics described in the report closely connect the attack to the security risks surrounding developer environments. A compromised coding assignment or software installation can offer an attacker more than access to a single endpoint: it can reveal internal workflows, credentials, colleagues, development permissions and tools used to manage production systems.
The company's account also shows how an internal AI system can become a risk multiplier if an attacker has already obtained access through an employee device. Binance did not describe the specific AI tool or the commands involved, but said it was used to take control of two additional engineers' devices. That places identity controls, device permissions and monitoring of automated internal tools alongside traditional wallet security as critical defenses for large custodians.
Withdrawals reopened across major networks
Binance said it closed the entry points used in the attack, rebuilt or replaced affected systems and strengthened device controls. It also expanded AI-based behavioral anomaly detection and said it is commissioning an independent cybersecurity review.
Withdrawals were reopened in phases beginning at 4 a.m. UTC on Nov. 3, according to the exchange. Binance said it restored service for dozens of assets on BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, TRON and Base, with tokens prioritized according to customer demand over the preceding week.
The exchange later said hourly deposits exceeded withdrawals after services began returning. Reopening withdrawals across multiple networks required Binance to restore confidence in the operational controls around each affected wallet environment, rather than simply restarting a single platform function.
Binance's statement that it replenished 98% of affected assets suggests the company absorbed most losses tied to customer balances while pursuing recovery of stolen funds. Its reported $2.85 billion in frozen or intercepted assets represents a substantial portion of the alleged theft, although the two figures measure different parts of the response: one concerns assets blocked or recovered, while the other concerns replenishment of affected holdings.
North Korea attribution raises political tension
North Korean authorities publicly rejected the FBI's alleged attribution. On Nov. 2, Kim Yo-jong, the sister of North Korean leader Kim Jong-un, called the FBI's claims a "grave political provocation," Binance said in its update.
The attribution dispute adds a geopolitical dimension to an incident already shaped by long-running concerns about state-linked theft from cryptocurrency businesses. Binance's report does not present the event as a one-time exploit of a wallet vulnerability. It describes an extended campaign in which attackers studied personnel, manipulated normal engineering and recruitment practices, and then used legitimate internal access to reach systems tied to asset transfers.
For centralized exchanges, the episode puts renewed pressure on the separation between employee workstations and wallet authorization environments. Rotating credentials and replacing compromised devices can contain an early intrusion, but the reported sequence shows how knowledge gathered in an initial failed or limited compromise can support a later attempt against different employees and systems.
Binance said the affected infrastructure has been rebuilt or replaced and that its security review is under way. The outcome of that review will determine whether the exchange's new controls can prevent a similarly patient campaign from turning employee-level access into another attack on wallet operations.
Worried about similar attacks? Learn how to trade safely and avoid scams in our guide here.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
