Binance published its own incident report on Nov. 3, 20261. The report names one scam as the start of its record $6.34 billion theft. A fake job offer reached a Binance engineer in September. By Oct. 29, the same scam had reached Binance's wallet-signing service. It traveled through a tool built to help: Binance's own internal AI assistant. Binance says it has already replenished 98% of what the theft cost2. Every crypto company that hires remotely and tests code from strangers faces the same opening.
A Download in June, Then a Job Offer in September
Binance's own timeline starts four months before the theft. In June, a wallet engineer searched for a popular AI coding tool2. A search ad led him to a tampered version of Homebrew. Developers use Homebrew to install software on a Mac. Binance caught the intrusion fast. It replaced the engineer's device and rotated his passwords. The damage stuck anyway. Whoever ran the ad now knew the engineer's job and his teammates' names. That detail turned a random ad into a targeted one. It gave the attacker a name and a title to try next.
September brought a second attempt, aimed at a different engineer. A recruiter reached him through a job-hunting site, posing as a company's project director5. Two rounds of interviews followed. One was with a fake HR staffer, who shared social accounts full of ordinary personal photos and videos to look real. The other was with someone who claimed to run the company. Near the end, the engineer got a homework assignment. He downloaded it onto his work computer. The code inside swapped a real developer tool for a fake one built to look the same. It then quietly phoned an outside server for instructions.
“It was not a single isolated breach or a simple phishing incident,” Binance said in its report. “The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method”5.
Both sides, in their own words
Does a trick that old explain a loss that size?
“This wasn't one mistake or one breach — it was a months-long campaign. We're publishing the full report because the lessons go far beyond Binance”
“Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest”
One AI Tool, Three Engineers, Nine Days
The September download gave the attacker a small foothold. On Oct. 20, the attacker turned that foothold into something bigger2. Binance's internal AI tool took commands from the compromised laptop. Engineers normally ask that tool to speed up routine work. Through it, the attacker reached two more engineers' computers. One of them held a container deployment token. A container is a sealed slice of software that runs one program's code. That token could launch new containers inside Binance's wallet-signing service. A signing service is the system that approves a transaction before a wallet sends it.
Binance kept these wallets online for speed. An exchange needs quick access to pay out withdrawals around the clock. A cold wallet stays offline instead. Many individual holders use one for that reason. Offline storage resists this exact kind of remote hijack, at the cost of the speed an exchange needs.
Attribution adds a separate layer to this story. The FBI linked the theft to a group it calls TraderTraitor3. That is the same name the bureau gave North Korea's $1.5 billion Bybit theft last year. North Korea's government denies every theft tied to that name, including this one. Binance's own report settles how the theft started. The question of who ordered it belongs to that separate, ongoing dispute, and a reader following the money should track both threads at once.
Nine Minutes Across Four Chains
Oct. 29 unfolded in timed stages5. The container went live between 17:15 and 19:56 UTC. Five hot wallets moved out minutes later, between 20:05 and 20:09 UTC7. The haul crossed four blockchains at once. XRP left first: 233.46 million coins. Solana and the Ethereum network Optimism followed, with about 970,500 SOL and 44.2 million OP. Bitcoin's share ran to 18,270 coins.
One more trick kept the theft going after that7. Binance had already cut off new withdrawals by then. A 2026 Ethereum upgrade called EIP-7702 lets a wallet add a smart contract's rules to its own address. Using that rule fifty times, the attacker built a new permission outside Binance's shutdown. A final stolen transfer left at 23:56 UTC: 2,961.9 ether. Binance closed that permission 14 minutes into Oct. 30.
On-chain trackers moved fast too. ZachXBT, a pseudonymous investigator who follows stolen funds across chains, posted a running tally the next morning9. His count became one of several independent checks on Binance's own recovery numbers in the days that followed.
ZachXBT@zachxbtUpdate: This brings the total frozen for the Binance exploit so far to over $2.83B pic.twitter.com/AX3utCiIPF
Binance's Wallets Emptied in 4 Minutes on Oct. 29; Its Report Came 5 Days Later
Dated steps from Binance's Oct. 29, 2026 theft to its Nov. 3, 2026 incident report, in order
Sources: The Block [2]; The Hacker News [5]; crypto.news [7].
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 20, 2026 | AI tool reaches 2 more. The attacker uses Binance's internal AI tool to reach two more engineers' computers |
| Oct. 29, 2026 | Container goes live. The attacker deploys a container between 17:15 and 19:56 UTC |
| Oct. 29, 2026 | 5 wallets drained. Five hot wallets empty across four blockchains between 20:05 and 20:09 UTC |
| Oct. 29, 2026 | Final ETH transfer. The last stolen transfer, 2,961.9 ether, leaves at 23:56 UTC |
| Oct. 30, 2026 | Binance revokes access. Binance closes the malicious EIP-7702 permission 14 minutes into the new day |
| Oct. 31, 2026 | 98% replenished. Binance says it has replenished 98% of the affected assets |
| Nov. 3, 2026 | Binance's report lands. Binance names the fake job offer and the AI tool behind the theft |
An Old Trick, a Record Loss
Binance's co-chief executive Richard Teng calls the theft a pattern built over five months. “This wasn't one mistake or one breach — it was a months-long campaign. We're publishing the full report because the lessons go far beyond Binance,” Teng said2. His framing puts the weight on persistence: five months, three engineers, one scam that finally worked, after dozens of near-identical attempts failed.
Binance lists its fixes plainly5. It rebuilt the wallet system in a fresh environment. Every touched device got replaced, and old credentials were canceled. Device scans grew wider, watching for odd behavior across the company. Binance is also funding new research into AI-related security risks, work it says an outside expert will review line by line3.
Michael Barnhart reads the same report differently. He is a researcher at the cybersecurity firm DTEX. “Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest,” Barnhart said6. His point cuts against the word Binance keeps reaching for: sophisticated. A trick that experts have tracked for years carries little surprise. It is a test, and Binance had already passed 57 earlier copies of it in 2026 alone2. The 58th copy worked because one engineer, on one ordinary day, treated a stranger's coding assignment as routine homework.
Both readings rest on the same report. Teng's math says one scam beat five months of defense. Barnhart's math says Binance knew the scam's shape 57 times over and still lost to the 58th copy. A joke about the June download made that gap visible within hours. ashen posted a rough but accurate guess at the cause minutes after Binance's report went up8.
ashen@ashen_one7 BILLION DOLLAR crypto hack came from a homebrew install from someone tryna vibecode something 😭 https://t.co/EvRrrAhGzX pic.twitter.com/fgUcSuaxpo
By the next morning, the joke had drawn more likes than Binance's own report. That gap is a small sign of how fast the internet reaches its own verdict1.
A Joke Outscored Binance's Own Nov. 3, 2026 Report by 1,834 Likes
Likes on two Nov. 3, 2026 posts about Binance's hack, fetched Nov. 4, 2026, 00:17 UTC
- ashen's joke post: 8,639 likes
- Binance's report post: 6,805 likes
Read the chart as a table
| Item | Value |
|---|---|
| Binance's report post | 6,805 likes |
| ashen's joke post | 8,639 likes |
By the numbers
- $6.34 billion: stolen from Binance on Oct. 29, 2026, the company's own incident report said1.
- 98%: the share of affected assets Binance says it had replenished by Oct. 31, 20265.
- 57: suspected North Korea-linked cyberattacks Binance says it blocked in 2026 before this one got through2.
- 4 minutes: the span, 20:05 to 20:09 UTC on Oct. 29, in which five hot wallets emptied across four blockchains7.
- $2.85 billion: in stolen assets Binance says it froze or intercepted during the investigation4.
- 6,805 likes: on Binance's own Nov. 3 report post, versus 8,639 on ashen's joke about it, fetched Nov. 4, 2026, 00:17 UTC18.
- $696.56: BNB's price as of 2026-11-04T00:16:56Z, CoinGecko said10.
What to watch
Teng says Binance is bringing in an outside reviewer to check its own account of the breach. That report's findings, once published, will test whether the mechanism Binance described holds up to an auditor outside the team that defended the system. Watch whether Binance's container-permission rules change for every engineer, beyond the three this breach touched. A fourth fake job offer caught before it reaches an engineer's laptop would be the clearest sign the lesson stuck. Other exchanges are watching too, and a second company naming the same playbook would show how far the lesson has already traveled.
Sources
- Binance, "29 October Binance Security Incident: Initial Findings and Response Update," post on X, Nov. 3, 2026, https://x.com/binance/status/2117626126214504729
- Jason Shubnell, "Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach," The Block, Nov. 3, 2026, https://www.theblock.co/news/business/2026-11-03-binance-hack-incident-report-north-korea-fake-job-interview-ai-tool-432406
- Tanaya Macheel, "Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto," CNBC, Nov. 3, 2026, https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html
- Bradford Betz, "Binance traces $6.3B crypto theft to multistage attack that began with fake interview," Fox Business, Nov. 3, 2026, https://www.foxbusiness.com/fox-news-tech/binance-details-how-fake-job-interview-led-6-3b-crypto-heist
- Ravie Lakshmanan, "Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft," The Hacker News, Nov. 3, 2026, https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html
- Elizabeth Howcroft and AJ Vicens, "Binance hackers used fake job interview in US$6.3 billion attack," Reuters, Nov. 3, 2026, https://www.itnews.com.au/news/binance-hackers-used-fake-job-interview-in-us63-billion-attack-630092
- Lawrence Mondal, "Binance details fake interview route into $6.34B hack," crypto.news, Nov. 3, 2026, https://crypto.news/binance-hack-fake-interviews-ai-tool-signing-service/
- ashen, "7 BILLION DOLLAR crypto hack came from a homebrew install from someone tryna vibecode something," post on X, Nov. 3, 2026, https://x.com/ashen_one/status/2117633867955720451
- ZachXBT, "Update: This brings the total frozen for the Binance exploit so far to over $2.83B," post on X, Oct. 30, 2026, https://x.com/zachxbt/status/2115972303913935209
- CoinGecko, "Binance Coin (BNB) price," Nov. 4, 2026, https://www.coingecko.com/en/coins/binancecoin