Binance Details Security Failures Behind Record $6.3B Crypto Hack
Ecosystem
English
News
Latest News
- Bitcoin
- Ethereum
- Altcoins
- Blockchain
- Regulation
- Markets
- Features
- Magazine
- Reviews
- Research
- Opinion
- Podcasts
- Newsletters
- Commissioned
- Articles
- Press Releases
- Special Projects
About
About Cointelegraph
- History of Cointelegraph
- Editorial Policy
- Ads Disclosure
- Financial Risk Disclaimer
In the world of cryptocurrency, a significant security breach has occurred:
Binance traces $6.3B hack to fake job interviews, compromised AI tool
Latest News
Published: Nov 3, 2026
Hackers exploited compromised employee computers and stolen credentials to breach Binance’s wallet infrastructure, according to the exchange’s investigation.
A seemingly innocuous coding assignment from a prospective employer was actually a step in a months-long cyberattack that resulted in the theft of $6.3 billion. This raises serious questions about the security measures in place to protect cryptocurrency exchanges from internal threats.
The Attack Unfolded as Follows:
The attack began in June when an engineer downloaded a tampered software package while setting up an AI coding tool. Binance detected the malware and replaced the device, but the attackers had already gathered information about the exchange’s wallet team.
In September, attackers posing as recruiters targeted another software engineer, tricking him into downloading a malicious file disguised as a coding assignment. This malware compromised the engineer’s work computer, evading Binance’s security protections.
On October 20, the attackers used the compromised computer and an internal AI tool to gain access to two additional engineers' systems, obtaining deployment credentials to install malicious software within Binance’s wallet infrastructure on October 29.
They then accessed Binance’s internal wallet-signing service, authorizing unauthorized cryptocurrency transactions.
Binance’s Analysis:
"This wasn’t one mistake or one breach—it was a months-long campaign," Binance co-CEO Richard Teng stated in a post on X on Tuesday.
The attackers also exploited Ethereum’s EIP-7702 mechanism, allowing wallets to delegate transaction permissions to smart contracts. This enabled unauthorized transfers to continue even after Binance suspended withdrawals. Its MPC wallet system, which distributes transaction signing control, complicated efforts to revoke these permissions.
Financial Impact:
The breach affected approximately $6.3 billion in digital assets. Binance reported that $2.85 billion had been frozen or intercepted. The exchange will absorb the losses and had replenished 98% of the affected token assets as of October 31.
International Response:
The FBI has attributed the attack to North Korean hackers. However, on Tuesday, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement, calling the FBI’s attribution politically motivated.