Hackers used a fake job interview and a tampered artificial intelligence tool to compromise a

Binance Reveals Job Interview Trap in Record $6.3 Billion Crypto Theft

Hackers used a fake job interview and a tampered artificial intelligence tool to compromise a Binance computer before draining $6.3 billion in cryptocurrency on October 29, 2026. The breach at the world’s largest crypto exchange began in June with a compromised coding tool and unfolded over months through targeted software developer vulnerabilities.

The sequence of events started when a wallet developer downloaded a rigged AI tool in June. Although Binance detected the incident, replaced the device, and updated credentials, the exposure remained active. In September, a second software engineer seeking employment downloaded a malicious code repository after virtual meetings with what the person thought was a legitimate role, including meeting virtually with the CEO of a fictitious company.

By October 20, the attackers used that compromised machine alongside an internal artificial intelligence system to seize control of the first wallet developer's infrastructure and a teammate's system. On October 29, the perpetrator executed a malicious script from the second developer’s machine using stolen credentials. The attacker triggered a sweeper contract that emptied 167,464 ETH and 63 tokens in minutes, according to Elliptic analysis.

FBI Attributes Massive Crypto Theft to North Korea

The FBI attributed the theft to North Korea’s TraderTraitor hacking group, naming the unit on October 31. Elliptic had assessed TraderTraitor as the likely culprit prior to the formal announcement. The scale of the breach stands more than four times larger than the $1.46 billion stolen from Bybit in 2025.

North Korea rejected the allegations through state communications. Kim Yo Jong, a top Democratic People’s Republic of Korea official and sister of leader Kim Jong Un, dismissed the claims on Tuesday as absurd rhetoric and a sinister attempt by the United States to damage Pyongyang’s image. Binance did not respond to queries regarding North Korea’s alleged involvement.

Withdrawal Resumption and Asset Recovery Efforts

Binance began reopening withdrawals starting with the Bitcoin network on November 1. The exchange reported that net withdrawals reached $4.72 billion as transactions resumed, a figure representing a limited portion of total assets standing at approximately $157 billion. Company representatives noted that withdrawal levels have stabilized to normal on-chain activity.

Blockchain partners and intelligence firms assisted in freezing roughly $2.85 billion to $3 billion of the stolen funds on-chain, primarily in USDT and USDC. Binance stated that it is repaying all customers who lost funds through the hack, utilizing the SAFU fund and corporate reserves to cover approximately 95% of the stolen assets.

In response to the breach, Binance is increasing investments in AI-enabled threat detection and working to establish a security research fund alongside initiatives with leading AI companies. The FBI continues to call on industry partners to help block cryptocurrency accounts linked to the TraderTraitor group.

More on this story: Cybersecurity Experts Warn AI-Enabled PHP Flaws Spark New Attack Era · AI-Driven Vulnerabilities Threaten Global Internet Security, Experts Warn