Binance Details How Hackers Stole $6.3 Billion Using Fake Job Interviews and an Internal AI Tool
A fake recruiter lured a Binance engineer into installing malware that backdoored a development tool; by Oct. 20, the FBI-identified North Korean unit TraderTraitor had used Binance’s internal AI to access wallets. The Oct. 29 theft continued for nearly two hours.
Binance has published a postmortem explaining how attackers stole $6.3 billion in what the company describes as the largest crypto theft to date, carried out over several months in 2026 using a combination of malware, fake job interviews, and Binance’s own internal AI tool.
The attack began in June when a developer downloaded a tampered installer spread through a malicious Google ad, exposing details about engineers and their workflows. Binance says its security team detected that initial malware and replaced the affected worker’s device. However, a second attack in September went undetected. In that incident, a separate engineer was targeted by someone posing as a recruiter who conducted multiple rounds of interviews, built trust through social media, and eventually prompted the engineer to download what appeared to be an interview assignment but was actually malware. The malicious software replaced a legitimate development tool with a backdoored version and established communication with an attacker-controlled server.
By October 20th, the attackers — identified by the FBI as a North Korean unit called “TraderTraitor” — used Binance’s internal AI tool to gain control over wallets belonging to the first compromised engineer and a third employee. On October 29th, they logged into the third employee’s computer and launched the theft.
Binance says it was unable to stop transactions that continued for nearly two hours after the first unauthorized transfers because the hot wallet used Multi-Party Computation (MPC), meaning there was no single private key available to immediately revoke the malicious authorizations.
CEO Richard Teng stated that no users are bearing losses. Approximately $2.85 billion in stolen assets has been frozen or intercepted, with 98% of impacted tokens already replenished and withdrawals broadly resumed. Binance also says it has previously prevented 57 suspected North Korea-linked cyber threat cases.
The postmortem leaves open questions about why the attack succeeded despite years of documented warnings about malware disguised as job interview materials, and provides little detail on how the internal AI tool was exploited by the attackers.