Binance says fake interviews and internal AI tools led to the $6.3 billion heist

What Binance disclosed

Binance has given its most detailed account yet of the October 29 attack that drained more than $6 billion in assets. CNBC reported that the exchange said hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure.

Co-CEO Richard Teng rejected the idea that one employee's laptop was a single point of failure. Instead, he described a campaign that ran for months and used several entry points, which is a different threat model from the one most security teams plan for.

June: the fake developer tool

The first step was a supply-chain trick aimed at a developer. CNBC reported that a Binance Wallet DevOps engineer downloaded a tampered Homebrew installation to install a popular AI coding tool after searching for it on a search engine.

The Hacker News reported that the starting point has been traced to a supply chain attack targeting an engineer from the Wallet DevOps team, who downloaded a trojanized Homebrew installer to install a popular artificial intelligence tool.

Teng summarised the same step on CNBC: in June the attackers set up a fake version of a developer tool and lured one of the engineers to install it. That is a well-known pattern, and it worked because the tool was something the engineer wanted.

September: the fake recruiters

The second step used a different lure. CNBC reported that in September the attackers posed as recruiters and ran a series of job interviews with another engineer, ending in a coding exercise containing hidden malware designed to evade security.

A coding exercise is a normal part of a hiring process, which is what makes the technique effective. It asks the target to run code on their own machine, in a context where running code is expected, and the malware only needs to survive long enough to establish access.

The pivot through AI tools

What followed is the part specific to this decade. CNBC quoted Teng saying that from there the attackers moved violently through Binance's internal AI tools and obtained access that breached the system authorising wallet transactions.

AI tooling inside an enterprise is often granted broad permissions because it is expected to read repositories, tickets and internal documents. That makes it a useful pivot point: an attacker who controls an engineer's session does not need a separate exploit for every system the assistant can already reach.

The damage and the recovery

The scale is on record. CNBC reported that Binance said attackers stole more than $6 billion in assets from the exchange, and that the October 29 attack was the largest crypto cyberattack on record.

Teng told CNBC that Binance has replenished 98 percent of $6.34 billion in affected assets and is still purchasing the outstanding, more illiquid assets. He did not attribute the attack to North Korea himself, but acknowledged that the FBI has linked it to hackers tied to the TraderTraitor group.

Why the single-employee framing matters

Teng's rejection of the single point of failure is a governance argument as much as a technical one. If one laptop explains the loss, the fix is device-level; if a months-long campaign used several lures, the fix is identity, segmentation and monitoring across the whole developer toolchain.

That distinction will shape how regulators and customers read the incident. A company that describes its breach as a chain of small failures is asking to be judged on how quickly it detects and contains, not on whether it prevented every entry.

Where this fits

The technical elements are familiar from this year's security reporting. This site covered credential exposure at an AI infrastructure provider and an earlier case of AI tooling being abused at scale, both of which describe the same commodity: trusted access to AI systems.

What Binance adds is the financial end of the chain. A stolen session that reaches an authorisation system is worth far more than a cloud bill, and the case shows that AI tooling is now part of the path to that system rather than a separate category of risk.

What security teams should take from it

The first lesson is that tooling supply chains deserve the same scrutiny as software dependencies. A developer searching for an AI coding tool and installing it is normal behaviour, and any organisation that has not reviewed how those installers are fetched is exposed to the same trick.

The second is least privilege for assistants. If internal AI tools can reach repositories, ticketing and wallet-adjacent systems, then compromising one engineer's session is equivalent to compromising several systems at once. The blast radius is set by what the assistant is allowed to do, a lesson already visible in earlier AI hardware compromises.

What is established, and what is not

Established: Binance said hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure; a Wallet DevOps engineer downloaded a tampered Homebrew installer for a popular AI coding tool in June; attackers posed as recruiters in September and used a coding exercise with hidden malware; they then moved through internal AI tools to a wallet authorisation system; Binance has replenished 98 percent of $6.34 billion in affected assets; the FBI has linked the attack to North Korean hackers. Not established: the exact number of employees compromised, and how long the intruders had access before detection.

The open question is whether the industry treats this as a crypto story or as an AI-tooling story. If it is filed under crypto, the same attack path will be rediscovered by the next company whose assistants have broad permissions and whose engineers install their own tools.