Binance has published an initial incident report on the October 29 attack, describing a months-long campaign that started with fake recruitment and ended with an internal AI tool being used to reach wallet infrastructure. The exchange puts total losses above $6.3 billion and says about $2.85 billion has been frozen or intercepted, while 98% of the affected assets have been replenished.
According to the report, attackers first targeted a wallet DevOps engineer in June through a tampered Homebrew installation; the device was replaced and credentials were rotated. In September, attackers posing as company executives approached another employee through a fraudulent hiring process and got him to download a malicious coding assignment. On October 20, they used that computer and an internal AI tool to reach two other engineers’ devices, where they found a container deployment permission. Nine days later, they deployed a container and ran a script that launched the wallet attack. Crypto Insiders notes that no private keys had to be stolen.
“This wasn’t one mistake or one breach — it was a months-long campaign,” co-CEO Richard Teng wrote on X. Binance says it has closed the entry points, rebuilt affected systems and expanded AI-based anomaly detection, and that it stopped 57 suspected North Korea-linked attacks in 2026. The FBI has attributed the theft to North Korea, which denies involvement. Withdrawals reopened in phases from November 3, and hourly deposits later exceeded withdrawals.
Track the market yourself with AiTraderView’s FREE tools: Crypto Cockpit for charts and 75+ indicators, Crypto Screener to find setups, and Crypto Portfolio to follow your holdings. Just create a FREE account and try them yourself!
Sources:
The Block: Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach
Crypto Insiders: Valse sollicitatie opende route naar miljardenhack bij Binance
⚠️ RISK WARNING & AI DISCLOSURE
- This information is generated by Artificial Intelligence (AI) and complex algorithms. While advanced, these systems can contain errors or inaccuracies and are for educational purposes only.
- Technical analysis provides no guarantees; this information is purely informative.
- All discussed scenarios are hypothetical and do not constitute predictions or expectations.
- Past performance is not an indicator of future results.
- This is not financial advice and is not intended as a call-to-action for the reader.
- No implicit direction is claimed, and no specific behavior of market participants is suggested.