Binance hack began with fake job interview, AI tool

Key takeaways

• Binance said in an initial incident report published on X on Tuesday, Nov 3, 2026, that the Oct 29 hack, which hit about $6.34 billion in digital assets, started with a fake job interview in September.
• A September coding "assignment" carried malware that the endpoint tools on the engineer's work computer did not catch, and on Oct 20 the attacker used an internal AI tool to take control of two wallet engineers' machines, Binance said.
• Binance said about $2.85 billion had been frozen or intercepted and that 98% of the affected token assets had been replenished as of Oct 31.
• The exchange said the FBI has indicated North Korea is responsible. North Korea has denied it.
• In Thailand, Binance TH still had crypto withdrawals paused for checks, The Pattaya News reported on Nov 3. The Thai SEC said it had found no significant impact on customer assets held by operators in Thailand.

The Binance hack began with a fake job interview. According to the exchange's initial incident report, published on X on Nov 3, 2026, attackers spent months inside its systems. A malicious coding test and a hijacked internal AI tool gave them control of the hot wallets that lost about $6.34 billion on Oct 29.

What happened: how the Binance hack worked

Binance's report describes a chain of intrusions rather than a single breach. Co-CEO Richard Teng told reporters the attack "was a campaign, built over many months," CoinDesk reported. Teng told CNBC on Tuesday that the attackers "spent months building their way in." He rejected the idea that a single employee's laptop was the failure point.

June: a tampered developer tool

In June 2026, a wallet engineer installed a tampered Homebrew package while searching online for an AI coding tool, Binance said. The exchange detected it, replaced the device and rotated the related credentials. Reuters, in a report carried by NBC News, said the engineer's role and those of others on the wallet team were still exposed to the hacker.

September: the fake job interview

In September, a Binance software engineer was approached through a fake recruitment process that included video and chat interviews, according to the report. CoinDesk said the first contact came through a legitimate job platform from someone posing as a project director. Reuters reported that the process included a virtual meeting with the CEO of a fictitious company. The engineer was told to download an "assignment" containing a malicious code repository. Binance said the malware replaced a legitimate development tool component and was not caught by its endpoint tools at the time.

Oct 20 to Oct 29: the internal AI tool and the wallet theft

On Oct 20, the attacker used an internal AI tool to gain control of a Wallet DevOps engineer and another wallet engineer, Binance said. The DevOps engineer held a container deployment token. Between 17:15 and 19:56 UTC on Oct 29, the attacker used stolen credentials to reach another engineer's computer, deploy a container and launch the attack script.

Binance said the attacker gained unauthorized access to an internal wallet signing service. The attacker submitted 50 signing transactions to manipulate an account nonce and set up an EIP-7702 delegation. That gave a malicious contract partial control of a hot wallet. Because the hot wallets used multi-party computation (MPC), there was no single private key that could quickly revoke the authorization. Suspending withdrawals alone did not cancel it on-chain, the report said.

What we know and what we don't know yet

What we know: Binance put the affected assets at about $6.34 billion. It said about $2.85 billion had been frozen or intercepted, a figure it called subject to reconciliation and price swings. It said it had set aside more than 100% of the loss, that 98% of affected token assets had been replenished as of Oct 31, and that it is still buying back less liquid assets. "Binance will absorb the financial impact of the stolen funds, not our users," the report said.

Binance said it has rebuilt the affected wallet system and the internal AI tool, replaced affected devices, decommissioned the related credentials and tokens, and run enhanced security scans on all employee devices. It has also commissioned an independent third-party cybersecurity review. The exchange said it detected and prevented 57 suspected North Korea-linked threat cases in 2026.

What we don't know yet: Binance has not said exactly how the internal AI tool was used to take over the engineers' machines. It said some technical details will stay confidential and its findings are subject to further review. The report does not name the hacking group. CNBC reported that Teng acknowledged the FBI had linked the attack to North Korean hackers associated with the TraderTraitor group, but did not make that attribution himself. North Korea has rejected the FBI's claim, Reuters reported.

Background

The Oct 29 theft is the largest crypto hack on record by reported value. Binance reopened withdrawals in phases from Nov 1, as covered in our earlier report on the Binance hack recovery and the Thai response. Fake recruiter schemes and poisoned developer tools are familiar tactics in attacks blamed on North Korea, and Binance said many of the 57 threat cases it blocked this year used similar methods. For the market backdrop, see the crypto daily brief for Nov 2 and our Binance coverage.

What it means for Southeast Asian investors

For Thai users, the main question is the local affiliate. Binance TH, run by Gulf Binance, first paused crypto deposits and withdrawals after the hack, The Pattaya News reported on Nov 3. Crypto deposits had since returned to normal and trading and Thai baht transfers were unaffected, but crypto withdrawals remained paused for further checks. Binance TH said customer assets are held in offline storage separate from the global platform. Thailand's Securities and Exchange Commission said it had found no significant impact on customer assets held by operators in Thailand. It told licensed operators to keep assessing risks and give customers accurate information if services are restricted.

For the wider industry, the report puts the weak point in staff devices and internal tooling rather than in the blockchain or the custody design itself. Exchanges in the region that run hot wallets, hire developers remotely or give AI tools access to internal systems may face more questions on these points from regulators and users. Bullquill has not independently verified Binance's account of the attack. See also our North Korea coverage.

Related on Bullquill

• Bitcoin Edges Up 0.32% on Oct 31, 2026 as Binance Covers 90% of Hack
• Bitcoin Slips 0.77% on Oct 30, 2026 as Binance Hack Fallout Lingers
• Bitcoin Rises 1.04% on Nov 1, 2026 as Binance Reopens Withdrawals
• Thailand no-confidence debate: Anutin, 17 ministers face provisional Dec 11 vote
• Bank of Thailand holds rate at 1%, lifts 2026 GDP forecast to 2.4%

This article is for information only and is not investment advice.