Binance Says Fake Job Interviews and Internal AI Tools Led to the $6.3 Billion Hack: Claimed vs Verified

Binance says the record Oct. 29 theft of about $6.3 billion started months earlier with a fake developer tool, a fake recruiter and a coding exercise hiding malware, and then ran through the company's own internal AI tools. Co-CEO Richard Teng laid out that timeline on CNBC's "Squawk on the Street" on November 3, according to CNBC's report. Binance published a security report the same day.

This is an attack story first and an AI story second. The AI part is specific: attackers used a search for an AI coding tool as the lure, and Binance says they later moved "through our internal AI tools" to reach the system that authorized wallet transactions. This post separates what Binance and outside analysts have said, what is still a gap, and what builders can change in their own setups. For the wider picture of attacks this month, see our October 2026 cyberattacks tracker.

TL;DR: what is claimed and what is verified

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What Teng said on November 3

Teng rejected the idea that one engineer's laptop was a single point of failure. The attackers, he said, "spent months building their way in." He described three stages, quoted by CNBC.

In June, attackers set up a fake version of a developer tool and lured one engineer into installing it. In September they posed as recruiters and ran a series of job interviews with another engineer, which ended in a coding exercise that "contained hidden malware designed to evade security." From there, in Teng's words, they "moved violently through our internal AI tools" and obtained access that breached the system authorizing wallet transactions.

CNBC also reports that Binance has rebuilt the affected wallet system and the internal AI tool, replaced compromised devices, decommissioned credentials and tokens tied to the affected engineers, and widened security scans across employee devices. Teng said Binance is bringing in an independent expert to review its work.

What the security report adds

According to CNBC's summary of the report, the preparation began in June, when a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation "to install a popular AI coding tool after searching for it on a search engine." Binance says it detected suspicious activity, replaced the engineer's device and rotated credentials as a precaution. But by then, the report says, the engineer's role and related colleagues on the wallet infrastructure team "was exposed to the hacker."

That detail matters. It means the first compromise was caught and cleaned, yet the attackers had already learned who worked on wallet infrastructure. Cleaning a device does not remove what the attacker learned about your people. Three months later, those colleagues were the targets of the recruiter approach.

How this fits the earlier Binance statements

Binance confirmed the incident the day after the theft (BleepingComputer published on October 30). In a statement to BleepingComputer, Binance linked the theft to a compromised laptop belonging to a DevOps engineer. The attacker reached a service container and submitted unauthorized withdrawal transactions. Binance said it had found no evidence of a leaked wallet private key, and that "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action." It also said it had uncovered additional points of breach.

The November 3 account is consistent with that: not one laptop, but a chain of footholds over months. What is new is the explicit role of internal AI tools and the recruiter lure. What is still missing is a technical description of the AI tool: what it could access, how the attackers authenticated to it, and why it could reach the wallet authorization system.

Who did it, and what is confirmed

TRM Labs attributed the theft to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38, according to BleepingComputer. Chainalysis said it confirmed that with a high degree of confidence. TRM called it the largest crypto theft on record, about four times the roughly $1.5 billion Bybit theft of February 2025.

Teng did not attribute the attack to North Korea himself. CNBC says he acknowledged that the FBI has linked it to TraderTraitor. We could not find a public FBI or Justice Department statement on this attack, so treat the FBI link as reported through Binance's executive, not as a published advisory. Binance has said it has not attributed responsibility to any individual.

Money: how much was lost, frozen and replenished

• Size: Binance puts the affected assets at about $6.34 billion. TRM reports about $6.36 billion across ten blockchains, most moved in roughly 20 minutes from 20:05 UTC on Oct. 29.
• Replenished: Binance says it has put back 98% of affected assets and is still buying outstanding, less liquid ones.
• Frozen: CNBC reports Binance and partners including Tether, Circle and Ripple froze about $3 billion, though some stolen funds continue to move through laundering channels. TRM's earlier count was about $2.7 billion frozen, with the attacker still holding more than 420,000 ETH and 18,270 BTC out of issuers' reach.
• Customers: Binance says it will cover all losses from its SAFU fund and company funds and that user funds are safe. It temporarily restricted certain withdrawals.

The frozen and held figures differ between sources and change by the hour. Treat them as snapshots.

Why the AI-tool angle matters for builders

Three patterns in this story apply to any team that uses coding agents and internal AI tooling.

1. Search results for AI tools are a lure. The June foothold came from a search for a popular AI coding tool, which led to a tampered package installer. Coding agents and CLIs are in heavy demand, so attackers register look-alike pages and packages. We covered a related pattern when a desktop app auto-installed coding-agent plugins: tools that install other tools widen the supply chain you have to trust.

2. Internal AI tools are a privileged hop. An internal assistant often holds tokens for many systems so it can be useful. If an attacker reaches it, they inherit that reach. The same logic drove the GitBook incident, where GitBook says an attacker using AI agents took infrastructure credentials and every API token had to be revoked. In both cases, the credentials around the AI layer were the prize.

3. AI also speeds up the attacker. The UK's NCSC warned that AI is shortening the time to attack, and Google's threat group documented LLMjacking, the theft of cloud AI access. Binance has not said the attackers used AI to carry out this attack. The reporting says the attackers used the company's AI tools, which is a different claim.

Gaps to watch

• No technical report yet. Binance says an independent review is under way. Until it lands, details such as the tool's permissions and the exact path to the signer are unknown.
• "Compromised AI tool" is ambiguous. CNBC's headline says the hackers used an "AI tool." Teng's words are "internal AI tools." Binance also says it rebuilt "the internal AI tool." Whether this is one system or several is not stated.
• Attribution is partly second-hand. The vendor attributions are from analytics firms. The FBI link is relayed by Binance. No government advisory has been found.
• Numbers will move. Frozen, recovered and replenished totals have changed several times in a week.

How to protect yourself and your team

These steps come from the attack chain Binance describes, not from a Binance recommendation list. The company has not published one.

1. Install from the vendor's own source. Do not follow a search ad to an installer. Pin the package name and publisher, and check checksums or signatures where offered. Verify the exact command from the vendor's documentation.
2. Treat every recruiter coding test as hostile code. Run it only in a throwaway virtual machine with no credentials, no SSH keys and no browser profile. Real employers rarely need you to run unknown code on your work laptop.3. Separate machines and identities. Do not do job interviews, side projects or tool experiments on the laptop that holds production or wallet access.
3. Cut the blast radius of internal AI tools. Give assistants and agents scoped, short-lived tokens, require human approval for actions that move money or change production, and log every tool call. For agent teams, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.
4. Assume a cleaned device is not a closed incident. If a colleague's device is compromised, treat the whole team as exposed. Binance's own report shows attackers came back to the same team three months later.
5. Rotate after any foothold. Revoke tokens and secrets tied to the people and tools involved, and widen scans to similar devices, as Binance says it has now done.

See also our look at a Railway engineer's claim that AI agents scanned and requested secrets, and how Goldman Sachs limited AI coding tools to engineers: both show organizations deciding who may run agentic tools near sensitive systems.

Phishing hook with an envelope, showing a fake recruiter lure in a Binance hack style social engineering attack

What happens next

Three things will settle the open questions. First, Binance's independent review and technical report. Second, any formal statement from the FBI or the Justice Department. Third, on-chain tracing as stolen funds move, where analytics firms such as TRM and Chainalysis publish updates. We will update this post when any of them appears.

Our read: the story is less about a clever exploit and more about trust. A search result, a recruiter and an internal assistant each looked routine. Defenders should map every place where a person or an AI tool can run code or hold credentials, and assume that is where an attacker will come in. If you build with coding agents, the lesson is practical: the tool you install, the code you run for an interview and the access your internal assistant holds are all part of your attack surface. Binance is one of the best-resourced security teams in crypto, and months of patient social engineering still got through.

Version details and figures in this post are accurate as of November 3, 2026, and may change as the investigation continues.

Related reading

• October 2026 cyberattacks tracker
• GitBook security incident: what to rotate
• Google GTIG on LLMjacking
• NCSC State of the Cyber Nation
• Postman desktop auto-installs coding-agent plugins
• Railway engineer, AI agents and a secrets request
• Goldman Sachs restricts AI coding tools
• Sources: CNBC, BleepingComputer