Binance's $6.34 billion theft ran through fake job interviews, a poisoned developer tool — and an internal AI tool

Update, November 5, 2026: Binance has still not published its findings anywhere other than X and LinkedIn, and has added no detail about the internal AI tool. Blockchain-analytics firm Elliptic, in an analysis last updated November 5, says the stolen funds were spread across about 12,000 wallets on 11 blockchains in the first three and a half days, that around $3.35 billion remained in theft-linked addresses, and that "nothing we have seen shows an AI agent making decisions" in the laundering. We have added these points below.

Sourcing note: Binance's report, "29 October Binance Security Incident: Initial Findings and Response Update", was published on November 3 as an X article and on LinkedIn. We could not open either page or find a copy on binance.com. Facts we attribute to "Binance's initial findings" come from those posts as quoted by Security Affairs, SecurityWeek, StepSecurity, crypto.news and The Block, with each point checked against at least two of them.

Binance says the October 29, 2026 theft of about $6.34 billion, the largest crypto theft on record, was the end of a months-long campaign. The attackers went through two compromised engineers and then an internal AI tool, which they used to take control of two more engineers' computers and reach the wallet signing service. The FBI attributes the theft to North Korea's "TraderTraitor" activity. Binance has not said what the AI tool was, what it was allowed to do, or how it was turned against its own staff. For defenders, that gap is the most important open question in the report.

The short version

On the evening of October 29, 2026 (UTC), attackers drained Binance hot wallets on about ten blockchains in a burst that started at 20:05 UTC. Binance suspended withdrawals and said customers would bear no loss. Co-CEO Richard Teng has since said 98% of the affected token assets were replenished out of Binance's own funds.

Binance's initial findings, published on X and LinkedIn on November 3, say the intrusion did not start with a single phishing email. They describe four stages:

• In June, a wallet DevOps engineer, searching the web for a popular AI coding tool, installed a tampered copy of Homebrew, the package manager many Mac developers use. Binance caught it, replaced the laptop and rotated credentials. But, it says, the attacker had already learned the engineer's role and who his colleagues were.
• In September, a second engineer was approached on a legitimate recruitment platform by someone posing as a project director. He went through two interviews and was asked to download a "coding assignment" onto his work computer. Setting it up replaced part of pyenv, a common Python version manager, with a malicious version that Binance says its endpoint protection did not detect.
• On October 20, the attackers used that laptop and "an internal AI tool" to take control of two wallet engineers' computers. One of them held a token allowing container deployments.
• On October 29, they used those credentials to deploy a container and run a script. That gave them the internal wallet signing service, which they had sign transactions outside the normal withdrawal process.

Think of it as a burglar who first studies the staff list, then gets one employee to carry in a box, and finally uses the office's own intercom system to open the doors of the people who hold the keys. The intercom here was an AI tool Binance built or deployed internally.

Timeline

All times UTC.

• June 2026 — Wallet DevOps engineer ("A" in Binance's report) installs a tampered Homebrew while looking for an AI coding tool. Detected; device replaced; credentials rotated. Attacker learns about A's role and colleagues (Binance's initial findings, as reported by Security Affairs, SecurityWeek and StepSecurity).
• September 2026 — Software engineer "B" is recruited through a legitimate job platform by a fake "Project Director", interviewed twice, and runs a malicious "assignment" repository on a work computer. A pyenv component is swapped for a malicious one, undetected by endpoint tools (Binance's initial findings, via StepSecurity, SecurityWeek and Security Affairs).
• October 20 — From B's computer, the attacker uses an internal AI tool to gain control of the computers of A and of wallet software engineer "C". A container-deployment token is found on A's machine (Binance's initial findings, via Security Affairs and crypto.news).
• At least 36 hours before the theft — Small Tornado Cash withdrawals fund an operator wallet; code is tested and rehearsed (TRM Labs).
• October 29, 17:15–19:56 — Attacker accesses C's computer, uses A's credentials to deploy a container and run a malicious script, and reaches the wallet signing service (Binance's initial findings, via StepSecurity).
• October 29, 20:05–20:09 — Five hot wallets send 233.46 million XRP to an attacker address; SOL, OP and 18,270 BTC follow (Binance, via crypto.news; TRM).
• October 29, 23:35 — Binance says verified frozen funds reached $2.54 billion (as reported by TRM).
• October 29, 23:56 — Final unauthorised transfer, 2,961.9 ETH, finalises (Binance's initial findings, via Security Affairs, SecurityWeek and StepSecurity).
• October 30, 00:10 — Binance clears the malicious EIP-7702 delegation on its "Binance 14" hot wallet (Binance's initial findings, via StepSecurity and crypto.news).
• October 31 — FBI alert attributes the theft to North Korea ("TraderTraitor") (FBI, as quoted by Security Affairs). Binance says 98% of affected token assets have been replenished.
• November 1 — Withdrawals begin reopening in phases, starting with Bitcoin (Elliptic; SecurityWeek).
• November 2 — Kim Yo Jong, Kim Jong Un's sister, calls the FBI's claims a "grave political provocation" (The Block; SecurityWeek).
• November 3 — Binance publishes its initial findings on X and LinkedIn; Teng says withdrawals have broadly resumed (Binance; SecurityWeek).
• November 5, 09:15 — Elliptic says around $3.35 billion remains in addresses linked to the theft.

What we know

The scale. Binance puts the impact at about $6.34 billion. TRM Labs, writing on October 29, counted about $6.36 billion across ten chains, "mostly within about 20 minutes", and called it the largest crypto theft on record, roughly four times the February 2025 Bybit theft. Elliptic counts $6.43 billion across 11 blockchains. Binance's November 3 update puts frozen or intercepted funds at about $2.85 billion, "subject to reconciliation and market price changes" (as reported by crypto.news); Elliptic has independently verified $2.85 billion frozen or seized, about 44% of the theft, almost all of it USDT and USDC. TRM's own October 30 tally of issuer freezes (Tether, Circle, Ripple, World Liberty Financial, the Arbitrum Security Council) was about $2.7 billion.

Who pays. Teng wrote on X: "We take full responsibility and we're making it right. No user bears the loss" (quoted by crypto.news). Binance says it set aside more than the full amount.

Who did it, according to whom. The FBI says North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026", and names the activity TraderTraitor. It is working with the US Secret Service and IRS Criminal Investigation and expects the assets, converted "primarily into Ethereum", to be laundered further through DeFi and instant-swap services (FBI alert, as quoted by Security Affairs). TRM independently attributes the theft to TraderTraitor "with high confidence", citing similarities to the Bybit and April 2026 KelpDAO thefts. Chainalysis also attributes it to TraderTraitor with high confidence; according to CoinDesk, its strongest evidence is that stolen Binance funds were mixed with proceeds of September's roughly $388 million Bitget hack, also attributed to North Korea. Binance's report cites the FBI rather than making its own attribution. North Korea denies involvement.

How the attacker got in. Binance's initial findings, as relayed by several outlets that read them, describe a chain of four steps across three engineers. The September step is the classic "Contagious Interview"-style lure: a fake recruiter, a fake company, a take-home task. But it has a twist that matters to every developer. The malicious code did not arrive as an obvious executable. It ran during project setup and replaced a component of pyenv installed through Homebrew. StepSecurity, relaying the report, says the legitimate file was 3,344 bytes and the replacement 3,414 bytes. Binance's wording, as quoted by SecurityWeek: "The 0-day malware was not detected by the endpoint security protection tools at the time."

The AI tool sentence. The key line, as quoted by Security Affairs: "The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C." That is all Binance has published about it. The report does not name the tool, say who built it, what model it uses or what it could do. Binance says it has rebuilt the affected internal AI tool. As of November 5 it had added nothing further.

How the money moved. On Ethereum, the attacker used EIP-7702, a 2025 Ethereum feature that lets an ordinary account delegate some execution rights to a smart contract, to make a Binance hot wallet run attacker-controlled code. TRM says a single transaction carried 50 pre-signed authorisations covering 50 consecutive nonces, so one would be valid. Binance explains why pausing withdrawals did not stop the drain: the delegation already lived on-chain, and "because the hot wallet used Multi-Party Computation (MPC), there was no single private key" that could immediately revoke it, so it needed a dedicated revocation procedure (quoted in part by note.com; paraphrased by Security Affairs, SecurityWeek and crypto.news). In Binance's words, as quoted by SecurityWeek, "suspending withdrawals alone could not stop all unauthorized asset movements." On other chains the transfers were ordinary signed transactions.

How the money is being laundered. Elliptic says the laundering looks "almost certainly software-driven", with funds moved through about 12,000 wallets across 11 blockchains and more than 40,000 transactions in the first three and a half days. It adds that "nothing we have seen shows an AI agent making decisions". In other words, the automation looks like ordinary scripts. Around $3.35 billion remained in theft-linked addresses as of 09:15 UTC on November 5, Elliptic says.

Context Binance offers. Binance says it detected and prevented 57 suspected North Korea-linked threat cases in 2026, including fake job interviews and malware disguised as development tools.

Technical analysis

Root cause, in one line. A developer workstation was trusted far beyond what a developer workstation should be trusted with. From B's laptop the attacker could reach colleagues' machines; from A's machine a token could deploy containers; from a deployed container a script could talk to the signing service. Each hop is a trust decision someone made for convenience. The AI tool was one of those hops.

Why the endpoint controls failed. The September payload did not need to look like malware. Developer environments constantly rewrite their own tooling: package managers update binaries, version managers swap shims, setup scripts run arbitrary commands by design. To most endpoint products, a replaced pyenv script that is 70 bytes bigger than the original looks the same as a normal upgrade. StepSecurity makes the same point: version numbers alone do not establish exposure, because a legitimate update also replaces files. Our assessment: "Run the recruiter's repo" is now as dangerous as "open the invoice attachment", and EDR tuned for the second does little for the first.

What the AI tool probably was, and what we must not assume. Binance's verb is "gain control over". Taking control of a colleague's computer from your own requires something on those computers that accepts instructions from the network. Our assessment: the most plausible reading is that the internal AI tool could reach, or execute actions on, other employees' machines or the systems that manage them. That could be a coding or operations assistant with remote-execution, device-management or shared-session capabilities, driven by the attacker with B's identity. That is an inference, not a finding. Binance has not said whether the tool was abused through its intended features (an authorised user asking it to do something it should not allow), through a flaw in it, or merely as a relay for stolen credentials. It has not mentioned prompt injection, and nothing published suggests the model "decided" anything.

What is new about the AI angle. Three things.

First, internal AI tooling as an internal pivot. We have covered attackers using AI to write lures and malware, and attackers stealing AI API keys. This is a different category: an organisation's own AI tool, deployed for productivity, used as a lateral-movement channel inside the network. Internal AI assistants are typically granted broad, cross-system reach because that is what makes them useful. They are also often classified as "productivity software" rather than as privileged infrastructure. If an AI tool can act on other people's machines, it is a remote administration tool, and it inherits that threat model.

Second, AI tools as bait. The June foothold came from a tampered installer found while searching for an AI coding tool. Popular AI developer tools are new and change fast, and the people who install them are used to piping install scripts from the web. That makes them an ideal lure. (This is the lure, not the internal tool; the report does not link the two.)

Third, the asymmetry of disclosure. Binance published byte sizes for the malicious pyenv file but nothing about the AI tool. Our assessment: for the wider industry, the second is far more useful. Thousands of organisations are rolling out internal assistants with tool access this year; they need to know which design property made this one abusable.

Why the blockchain controls did not save the day. Pausing withdrawals is a control on Binance's own processes. EIP-7702 delegations and pre-signed authorisations are state on a public chain that Binance does not control. Once the signing service had signed them, the protections had to work on-chain. MPC spreads key material so no single person holds a key. That also meant no single key could quickly sign a revocation. Two security properties, distributed custody and fast emergency response, pulled against each other. It took Binance about four hours from the first outflow to clear the Ethereum delegation.

What remains unclear

• The AI tool. Its name, whether it came from a vendor or was built in-house, its model, purpose and permissions, how it reached A's and C's machines, whether a flaw was involved, and what "rebuilt" means. Binance says some details will stay private (per note.com).
• June to October. StepSecurity notes the report does not establish uninterrupted access from June to October. Did the June compromise leak anything beyond org-chart knowledge? Why was a container-deployment token still on A's device in October?
• The numbers. $6.34 billion (Binance) vs $6.36 billion (TRM) vs $6.43 billion (Elliptic). Frozen funds were reported as about $3 billion on October 30 and about $2.85 billion on November 3. Replenishment was 98% "as of October 31", a figure SecurityWeek attributes to Teng, vs about 95% in Binance updates on November 1–2 (per note.com). None of these differences is explained.
• Detection. How did nine days pass between control of the wallet engineers' machines (October 20) and the theft? What alerted Binance on October 29?
• The independent review. Binance says it engaged independent cybersecurity firms but has not named them or promised a final report date.
• Attribution detail. The FBI alert's technical basis is not public. North Korea denies. Binance has not tied this campaign to a specific earlier lure, and the June Homebrew installer has not been linked to a known campaign.
• The primary itself. As of November 5, Binance's findings were available only as an X article and a LinkedIn post, with no copy on binance.com that we could find.

Lessons and what to do

For security teams

• Inventory your internal AI tools by what they can do, not what they are called. Any assistant that can run commands, open sessions, push code or call internal APIs on behalf of a user is a privileged access path. Put it in the same tier as remote-administration and CI/CD systems: strong authentication, per-action authorisation, full logging, alerting on cross-user or cross-device actions.
• Treat developer setup as code execution. Recruiter assignments, sample repos and "quick start" scripts should never run on corporate machines. Give developers isolated, disposable environments for anything from outside.
• Watch the toolchain itself. Monitor for changes to package-manager directories, version-manager shims and shell start-up files outside normal update windows.
• Get deployment credentials off laptops. A token that can deploy to production should not live on a workstation. Use short-lived, just-in-time credentials issued through a broker that requires a second person or a second factor.

For AI builders

• Design internal agents with least privilege per request, not per tool: the assistant should act with the caller's rights for that task only, and never on another user's device without that user's explicit approval.
• Make actions attributable. Every action an agent takes should be logged with the human who asked, the prompt and the target, so a "B controls A's laptop" event stands out.
• Assume your tool will one day be driven by a stolen identity. Rate-limit and alert on unusual targets and volumes.

For leadership

• Ask for the list. Which internal AI tools exist, who owns each, and which can act on systems rather than just answer questions?
• Fund developer-endpoint security as critical infrastructure. Binance's own fix list shows what it costs after the fact: rebuilt wallet systems and AI tool, replaced devices, retired credentials and tokens, more behavioural monitoring, an independent review.
• Weigh custody design against response speed. Distributed signing is good; make sure there is also a rehearsed way to revoke on-chain permissions quickly.

Sources

• Binance, "29 October Binance Security Incident: Initial Findings and Response Update", November 3, 2026: X article (also on LinkedIn). Not opened by us; read via the coverage below.
• FBI, "North Korea Responsible for $6 Billion Binance Attack" (alert), October 31, 2026
• TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", October 29, 2026
• Elliptic, "The largest theft in history: North Korea likely behind the $6.4 billion Binance hack", October 30, 2026 (final update November 1)
• Elliptic, "How North Korea is laundering the $6.4 billion stolen from Binance", November 3, 2026 (updated November 5)
• Richard Teng on X, November 3, 2026
• EIP-7702 specification

Coverage:

• Security Affairs, "Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack", November 3, 2026
• Security Affairs, FBI blames North Korea, November 1, 2026
• SecurityWeek, "Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist", November 4, 2026
• StepSecurity, Binance hack and developer machine security (updated November 3, 2026)
• crypto.news, "Binance details fake interview route into $6.34B hack", November 3, 2026
• The Block, Binance incident report, November 3, 2026
• The Block, CZ interview, November 3, 2026
• CoinDesk, "What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist", November 5, 2026
• Bitcoin.com News, November 3, 2026: news.bitcoin.com
• zephel01 on note.com (Japanese reading of the report), November 4, 2026: note.com
• Cloud Security Alliance research note, "From One Laptop to $6.3 Billion"