AnswersPublished30 sources
How a Fake Job Interview Led to Binance’s $6.3 Billion Hack
Binance’s November 3 account says attackers spent months targeting employees before using compromised computers and an internal AI tool in a theft of about $6.3 billion. Binance reported about $3 billion frozen or secured and said company funds would cover the loss; Reuters also reported different replenishment figu...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Binance’s November 3 account says attackers spent months targeting employees before using compromised computers and an internal AI tool in a theft of about $6.3 billion.
- Binance reported about $3 billion frozen or secured and said company funds would cover the loss; Reuters also reported different replenishment figures at different points in time.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did Binance’s November 3 report and media briefing reveal about the potentially record-breaking $6.3 billion wallet theft, including th. Article summary: Binance’s November 3 disclosures described a months-long infiltration involving compromised developer computers, fake recruitment and misuse of an internal AI tool, culminating in approximately $6.3 billion being stolen—. Topic tags: general, general web, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers
Binance’s November 3 disclosures describe a months-long campaign that began with attempts to compromise employees and ended with roughly $6.3 billion in digital assets stolen. The exchange says attackers used compromised computers and an internal AI tool to reach its wallet systems. The findings are preliminary, and the reported value makes the theft potentially the largest cryptocurrency heist on record. 17
19
48
A months-long path into the company
Binance’s reported timeline begins in June, when a Wallet DevOps engineer downloaded a tampered Homebrew installer while looking for a developer tool. The company detected suspicious activity, replaced the device and changed credentials. But accounts of the investigation say information about the employee’s role and colleagues had already been exposed. 22
36
39
In September, attackers approached another software engineer through a legitimate job platform and arranged fake recruitment interviews. Reporting says a malicious coding assignment was used to compromise the employee’s computer. 14
23
24
Binance later said attackers used a compromised computer and an internal AI tool to access wallet infrastructure. The disclosures describe a chain of employee and system compromises, rather than a simple theft of a single password. 17
19
37
The theft and its reported scale
The unauthorized transfers took place on October 29. TRM Labs estimated that about $6.36 billion moved across 10 blockchains, with most of the transfers occurring in roughly 20 minutes. Reporting on the Ethereum portion describes the use of EIP-7702, a mechanism that can authorize a wallet to operate using smart-contract code. These are reported investigative findings; the supplied accounts do not independently establish every step of the attack. 2
16
The November 3 disclosures describe access to internal wallet systems and the use of compromised computers and credentials. The available reporting does not justify treating the incident as proof that private keys were leaked. Nor does the information here establish a definitive minute-by-minute sequence for the attack and its containment. 17
19
37
What Binance said about recovery
Binance said roughly $3 billion in affected assets had been frozen or secured with help from industry partners, and that it had reserved more than $6.34 billion in company funds to cover the stolen assets. A freeze or company-funded replenishment is not the same as recovering funds from the attacker. 48
The reported replenishment figures differ: Binance’s published update said 98% of affected tokens had been replenished as of October 31, while Reuters reported on November 3 that co-CEO Richard Teng put replenishment at 95%. The excerpts do not explain the difference in timing or calculation. 18
30
Binance also said withdrawals were being restored in phases, with more assets and networks reopening subject to security checks. Teng said outflows had largely normalised and that the company would publish a post-mortem in due course. 12
18
31
Attribution and next steps
The FBI attributed the theft to North Korean actors identified as TraderTraitor, and blockchain investigators also linked the operation to that group. North Korea rejected the U.S. allegation. Attribution is therefore an investigative finding, not a claim Binance itself had publicly confirmed in the cited reporting. 7
15
47
Binance said it had detected and prevented 57 suspected North Korea-linked cyber threats during 2026. The company also said it planned to increase investment in AI-enabled threat detection and work on a security research fund and initiatives with AI companies. Those measures, along with the promised post-mortem, may add detail to what remains an initial account of how a prolonged employee-targeting campaign reached the exchange’s wallet infrastructure. 19
21
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How a Fake Job Interview Led to Binance’s $6.3 Billion Hack"?
Binance’s November 3 account says attackers spent months targeting employees before using compromised computers and an internal AI tool in a theft of about $6.3 billion.
What are the key points to validate first?
Binance’s November 3 account says attackers spent months targeting employees before using compromised computers and an internal AI tool in a theft of about $6.3 billion. Binance reported about $3 billion frozen or secured and said company funds would cover the loss; Reuters also reported different replenishment figures at different points in time.
Sources
reuters.comBinance hackers used fake job interview to compromise computer before $6.3 billion attack
rmb.reuters.comBinance says hackers used fake job interview to compromise computer before $6.3 billion attack
apnews.comWhat to know about the $6.3B Binance hack
mezha.uaBinance Reveals How Hackers Stole $6.34 Billion Using a Fake Job Interview and Internal AI Tool