Binance has published its first detailed account of how the record $6.3 billion+ theft actually happened — and it is uglier than a single phishing click.
In findings released on 3 November 2026, the world’s largest crypto exchange said the 29 October incident was a “sophisticated, multi-stage campaign” that combined fake job interviews, a poisoned developer install, endpoint malware, abuse of an internal AI tool, and unauthorised access to wallet signing systems.
“This should not have happened,” Binance said, apologising for the disruption. The company also says users are not bearing the loss: about $2.85 billion in stolen assets has been frozen or intercepted, roughly 98% of impacted tokens have been replenished, and withdrawals have broadly resumed.
The new postmortem matters because it turns a vague “points of breach” story into a concrete playbook — one every Indian exchange, fintech, SaaS company and DevOps team should study.
What Binance now says happened
Binance’s line is explicit: this was not one isolated breach or a simple phishing incident. Attackers combined:
- social engineering via fake recruitment interviews
- malicious software downloads
- compromised internal AI tooling
- endpoint compromise
- an advanced transaction-authorisation method
US agencies and analysts have linked the operation to North Korea’s TraderTraitor unit (also associated with Lazarus Group). Binance now cites FBI information indicating the DPRK is responsible. North Korea has denied the accusation.
Treat the attribution as a serious intelligence/law-enforcement assessment — still contested by Pyongyang, and not the same thing as a finished courtroom verdict.
Stage 1 — June 2026: poisoned AI-tool install
The campaign did not start on hack day. It started months earlier.
In June 2026, a Wallet DevOps engineer (“Engineer A”) searched for a popular AI tool and downloaded a trojanized Homebrew installer. Reporting around the postmortem says the poisoned installer was distributed through a malicious search/ad path.
Binance says it detected that compromise, replaced the device and rotated related credentials. But the attacker still walked away with useful intelligence: Engineer A’s role and details about colleagues on the wallet infrastructure team.
That is the quiet part of modern intrusion: even a “contained” malware hit can become reconnaissance for the next stage.
Stage 2 — September 2026: the fake job interview
In September, attackers contacted another engineer (“Engineer B”) through a legitimate job-hunting platform, posing as a Project Director.
The social engineering was multi-layered:
- a first-round interview with a fake HR representative
- a second-round interview with someone claiming to be CEO of a non-existent company
- social media accounts with personal photos/videos used to build trust
- near the end, an instruction to download an “assignment” onto a work computer
That assignment was malware. Binance says it used advanced obfuscation and evasion, including replacing a legitimate development-tool component (reporting points to a poisoned pyenv-style swap) to run commands and talk to an attacker-controlled server. Forensic traces were cleaned. Endpoint tools did not catch it at the time. Binance calls it 0-day malware relative to its then protections.
This is why “don’t run interview homework on a production laptop” is no longer optional policy language. It is incident-prevention architecture.
Stage 3 — October: internal AI tool + wallet signing
On 20 October, attackers used Engineer B’s compromised machine and abused an internal AI tool to gain control linked to Engineer A and a third wallet software engineer (“Engineer C”).
Binance has not published a full technical teardown of that AI tool’s permissions model — an important gap. What it does say is that the attacker found a container deployment permission token on Engineer A’s computer.
On 29 October between 17:15 and 19:56, the attacker logged onto Engineer C’s computer, used credentials stolen from Engineer A, deployed a container, and triggered a malicious script.
From there, unauthorised access to an internal wallet signing service let them initiate transactions outside the normal withdrawal process. Reporting on the postmortem also revisits why stopping the bleed was hard after the first transfers: because the hot wallet used MPC (multi-party computation), there was no single private key that could immediately revoke malicious EIP-7702 authorisations.
That detail connects the November findings to the earlier on-chain picture: this was less “they stole one seed phrase” and more “they captured the machinery that authorises movement.”
What Binance says it has fixed — and repaid
As of the 3 November update, Binance says it has:
- reconstructed the affected wallet system in a new environment
- rebuilt the internal AI tool and access controls
- replaced affected devices
- decommissioned related credentials and tokens
- run enhanced security scans across employee devices
- strengthened wallet-service risk controls
- expanded AI-based behavioural anomaly detection
- worked with law enforcement and blockchain partners on freezes/recovery
Richard Teng’s update: no user is bearing the loss; about $2.85bn frozen/intercepted; 98% of impacted tokens replenished, remaining 2% in progress; withdrawals broadly resumed. BBC reporting adds that customers withdrew billions after services returned, and that Binance set aside more than 100% of funds needed to cover the loss.
Binance also says it has foiled 57 suspected North Korea-linked cyber threat cases since the start of the year — a reminder that this was not a one-off lucky shot against a soft target. The attackers kept trying until a multi-month path worked.
This playbook was already being rehearsed
Chainalysis says it has attributed more than $14.3 million in losses over the past 18 months to similar North Korea-linked fake interview schemes. Smaller compromises — from tens of thousands to millions — appear to have been practice runs before a top-tier target.
Across cases, victims have had private keys stolen from cloud storage after bogus interviews. Techniques also include resilient command-and-control methods such as EtherHiding-style channels spanning multiple chains.
Fake interviews sit inside a wider DPRK illicit employment/crypto ecosystem, alongside fraudulent IT worker schemes and laundering networks. That context matters for hiring managers: the “recruiter” may not be fishing for talent. They may be fishing for privileged endpoints.
What India should change this week
If you run engineering, security or hiring at an Indian crypto exchange, bank, fintech, SaaS company or IT services firm, the operational lessons are immediate:
- Interview code never runs on production laptops. Use disposable VMs or dedicated assessment machines with no wallet, cloud admin or signing access.
- Treat job platforms as an attack surface. Verify companies, domains, interviewer identities and LinkedIn graphs before any download.
- Separate developer tooling installs from privileged environments. Homebrew/AI coding agents on wallet/signing hosts is a design failure.
- Scope internal AI tools like production APIs. If an AI assistant can reach credentials, deploy tokens or peer systems, it is part of your privileged attack path.
- Assume endpoint malware will try to replace legitimate toolchains (compilers, version managers, plugins) and monitor for binary swaps.
- Plan revocation for MPC / EIP-7702-style authorisations in advance. “We can’t instantly revoke” cannot be discovered during the incident.
- Train staff on contagious interviews the same way you train them on phishing — because that is what this is.
Confirmed vs still thin
Confirmed by Binance / major reporting around 3 Nov 2026:
- Multi-stage campaign from June → September → October → 29 Oct theft
- Trojanized installer path against a Wallet DevOps engineer
- Fake interview + malicious assignment against a second engineer
- Internal AI tool abuse used to expand control
- Container deploy / signing-service path into unauthorised transfers
- User-loss cover, freezes, ~98% token replenishment claim, withdrawals broadly resumed
- FBI-linked DPRK responsibility cited by Binance; North Korea denies
Still thin / easy to oversell:
- Full technical detail on how the internal AI tool was permissioned and abused
- Complete public list of every control failure that made lateral movement possible
- Independent audit results (Binance says it is engaging third-party review)
- Final recovery totals for every unfrozen asset class
Bottom line
The Binance heist was not magic cryptography. It was patient social engineering against engineers, malware that beat endpoint tools, privilege tokens sitting where they should not, an internal AI surface that became a bridge, and a signing path that kept moving value after the alarm bells started.
If your security programme still treats “recruitment” as HR’s problem and “AI tools” as a productivity win, this postmortem is the correction.
Hiring is now part of cyber defence. Developer laptops are production-adjacent. Internal AI is infrastructure. Act accordingly.
FAQ
What did Binance’s new postmortem reveal?
That the ~$6.3bn theft was a months-long campaign using a poisoned AI-tool install, fake job interviews with malware “assignments,” abuse of an internal AI tool, and unauthorised wallet-signing access — not a single phishing click.
Did hackers steal Binance private keys?
Binance’s earlier findings said there was no evidence of a wallet private key leak. The new account focuses on compromised engineer endpoints, tokens, an internal AI tool, and signing-service abuse, including difficulty revoking malicious EIP-7702 authorisations under MPC.
How did the fake interview work?
An engineer was contacted on a real job platform, put through multi-round interviews with fake company staff, shown social proof, then told to download an assignment onto a work computer. That assignment installed stealth malware.
Are Binance users covering the loss?
Binance and CEO Richard Teng say no. About $2.85bn has been frozen/intercepted, ~98% of impacted tokens replenished, remaining 2% in progress, and withdrawals have broadly resumed.
Who is blamed?
Binance cites FBI information pointing to North Korea / TraderTraitor. North Korea denies involvement.
What should companies do now?
Ban interview code on privileged laptops, harden developer installs, tightly scope internal AI tools, monitor for toolchain swaps, and pre-plan signing/authorisation revocation.
