Update, Nov. 5: Federal Reserve and Office of the Comptroller of the Currency supervisors began contacting U.S. banks Monday to ask about vulnerabilities and unusual activity after the Binance theft, according to people who spoke to Reuters, The Primary Wire reported. Separately, Bloomberg reported that T3, a crypto crime-fighting alliance Binance had joined, quietly disbanded in the months before the theft, as The Primary Wire reported.
Binance said a months-long campaign that began with a tampered download and a fake job interview, then ran through an internal artificial intelligence tool, gave attackers the access they used to take about $6.34 billion in digital assets Oct. 29, BleepingComputer reported Tuesday. The account shows how routine hiring lures aimed at engineers, combined with in-house AI tools that can reach colleagues' computers, can turn one infected laptop into a route to systems that move money.
What Happened
In its initial incident report, the exchange said that in June a wallet engineer downloaded a tampered copy of Homebrew, a popular tool for installing software on Mac computers, while searching for an AI coding assistant. Binance caught it and replaced the device, but said the attackers had already learned his role and colleagues.
In September, a second engineer was approached on a job-hunting platform by someone posing as a project director. After two fake interviews, he was told to download a coding "assignment" onto his work computer. Its setup routine swapped a legitimate developer tool for a malicious copy that took orders from an attacker-run server. Binance called this previously unknown malware that its endpoint security tools did not detect at the time, labeling it a "0-day." Vulnerability analyst Will Dormann disputed that label on Mastodon, Help Net Security reported.
By Oct. 20, Binance said, the attacker had used the infected computer and an internal AI tool to take control of the first engineer's machine and a third engineer's, and found a container deployment token, a credential for pushing packaged software onto company servers. The report does not explain how the AI tool was used.
On Oct. 29 the attacker used the stolen credentials to reach Binance's internal wallet-signing service and move XRP, Solana, Optimism and bitcoin out of hot wallets, the online wallets used for everyday withdrawals. The attacker also abused EIP-7702, an Ethereum feature that let its own contract keep partial control of a hot wallet, so suspending withdrawals did not stop every transfer; Binance cleared that control Oct. 30.
Binance said about $2.85 billion has been frozen or intercepted and that 98% of affected token assets had been replenished as of Oct. 31, with the company, not users, absorbing the loss.
Attribution
The Primary Wire reported Nov. 1, citing AFP, that the FBI attributed the theft to TraderTraitor, a North Korean state-sponsored group. North Korea's Kim Yo Jong called the accusation "absurd," The Record reported. Binance says it blocked 57 suspected North Korea-linked attempts in 2026.
Co-CEO Richard Teng called the breach a "months-long campaign" rather than the result of "one mistake or one breach," according to The Record. In vendor research cited by SecurityWeek, blockchain analytics firm Elliptic said the funds moved through about 12,000 wallets on 11 blockchains in under four days.
Why It Matters
When The Primary Wire first reported the theft Oct. 30, citing the Associated Press, little was known about how attackers got in. BleepingComputer noted the lures closely resemble tactics researchers track as Contagious Interview and Operation Dream Job, in which fake recruiters send developers booby-trapped tests. North Korean schemes aimed at Western employers are also a sanctions priority: The Primary Wire reported Oct. 28 on Treasury penalties tied to IT worker fraud against U.S. companies.
The new element is the internal AI tool, which widened what one compromised laptop could reach. Boards should ask whether engineers with access to payment or deployment systems use separate devices for that work, whether developer software installs are reviewed, whether in-house AI assistants run with the least access they need, and whether deployment tokens expire quickly.
What to Watch
Binance says it is still investigating and is bringing in independent security firms to review its findings. Key open questions are what the internal AI tool was permitted to do and why endpoint defenses missed the malware. Elliptic counted about $3.18 billion still in theft-linked addresses as of Nov. 3.
