Binance says its $6.3 billion hack began with a fake job interview and a poisoned AI tool

Binance published an initial report on Tuesday on how attackers took about $6.3 billion from the exchange on October 29, and the entry point was a person, not a flaw in the blockchain. According to Reuters and NBC News, a software engineer on the wallet team downloaded a malicious code repository after interviewing for a job at what he believed was a real company. CoinDesk quotes co-CEO Richard Teng calling it "the biggest heist in crypto history."

The timeline Binance gave

• June: A wallet-team employee downloaded a tampered AI tool. Binance caught it, replaced the device and changed credentials, but that employee's role and those of colleagues on the wallet team had already been exposed. CoinDesk describes the tampered item as a Homebrew package.
• September: A second engineer, looking for work, went through interviews, including a video call with someone presented as the CEO of a fictitious firm. He was then told to download a coding assignment, which CoinDesk reports contained malware that evaded endpoint security.
• October 20: The attacker used that computer and an internal AI tool to take control of two wallet developers' systems.
• October 29: Using the second developer's machine and credentials stolen from the first, the attacker ran a malicious script. CoinDesk reports funds began leaving at 20:05 UTC.
• October 30, 00:10 UTC: Containment was complete, about four hours after outflows began.

Why it took hours to stop

CoinDesk reports the attacker used an Ethereum feature, EIP-7702, to gain execution rights over a hot wallet, which let money move outside the normal withdrawal process. Binance's hot wallets use multiparty computation, so, in the report's words as quoted by CoinDesk, "no single key could revoke it." That is a design choice meant to stop one stolen key from draining a wallet. CoinDesk links that design to why containment took hours.

We are relying on CoinDesk for this technical detail; Reuters and NBC summarize the report without it.

Money: frozen, replaced, still missing

CoinDesk reports Binance has frozen about $2.85 billion and has replenished about 98% of affected tokens from company funds, saying users "won't be affected." Reuters says Binance is repaying all customers who lost funds. Our earlier story reported the exchange citing 95% replaced on November 1, so the figure has moved up. The FBI has blamed a North Korean hacking group, which North Korea denies; for what analysts say happens to the stolen coins next, see our laundering story.

Figures differ by outlet: Reuters and NBC say $6.3 billion, while some crypto outlets print $6.34 billion and our laundering story cited Elliptic's $6.4 billion. We use $6.3 billion, the figure in Binance's own report as relayed by the wires.

What it means for anyone who runs a business with crypto or wallets

The lesson is not about Binance's size. The first compromise in June was caught and cleaned up, yet the people around it stayed exposed, and the real break-in came four months later through a different employee. For a small exchange, payments firm or any company holding digital assets, the practical checks are plain:

• Treat any job candidate's or recruiter's "coding test" as untrusted code. Run it only on a separate machine that holds no work credentials.
• After any incident, rotate credentials for everyone who could have been exposed, not just the affected device.
• Limit what an internal AI tool can reach. Reuters reports the attacker used one to move between wallet developers' systems.

Binance says it will spend more on AI-based threat detection, set up a security research fund and work with AI companies on targeted initiatives. CoinDesk adds that independent cybersecurity experts will review the incident. The report is described as initial, so expect more detail later.

Bitcoin so far

Bitcoin was near $77,604 on November 3, about 10.4% below its September 21 high in the six-month window shown below, per Yahoo Finance data. Live prices are on our crypto prices page.

Sources: Reuters via Investing.com; NBC News; CoinDesk. Binance's report is described as initial and its figures may change. Information, not investment advice.