Binance blames fake job interview and AI tool misuse for $6.3B hack

According to Binance, the $6.3 billion theft from its wallets on October 29 was the culmination of several months of planning.

In its incident report dated November 3, the exchange describes how hackers used tampered software and a phony job interview to gain access to the exchange. Ultimately, the thieves were able to use an internal AI tool to reach the wallets used by the Binance exchange.

A breach that started with a tampered download in June

In June, a wallet engineer downloaded a tampered installer while installing an AI coding tool. Binance caught the malware, replaced the laptop, and reset the login details. However, the attackers had already figured out the engineer’s role.

In September, another engineer went to two interviews with a fake company, following which he downloaded a harmful coding assignment. Then, on October 20, the attackers used his computer together with an internal AI tool, which was used to reach two wallet developers. On October 29, both the stolen credentials from him and a harmful script reached the wallet-signing operations, as reported by Binance.

XRP out of five wallets in four minutes

The attackers acted quickly as soon as they got inside. Five active wallets transferred a massive amount of 233.46 million XRP within four minutes. Soon, Bitcoin and other coins also moved. Although Binance blocked the withdrawal of funds, the hacked on-chain permissions remained active. A special process was needed to terminate them, and the last illegal transaction occurred almost four hours after the initial theft of XRP.

On October 31, it was reported by Reuters that the FBI blamed the North Korean TraderTraitor hacking group. North Korea denied the accusations later on, according to the news agency.

Frozen funds, moving funds, and the ones Binance replaced

Three figures show the amount Binance has recovered along with the amount it has yet to recover. As per the exchange, $2.85 billion has been frozen or intercepted. It is also reported that as of October 31, 98% of token assets that were affected had been restored. However, restoring customer assets is not the same as recovering stolen crypto. According to Elliptic, about $3.18 billion is still left in wallets that are linked to the theft, mostly in bitcoin and Ether.

Tracking the remaining funds is another challenge. In just three and a half days, Elliptic traced about 12,000 wallets across 11 blockchains and more than 40,000 transactions. TRM Labs has released reports on self-minted tokens and chained bridges, which made it difficult to track wallet connections. Chainalysis also observed addresses that were funded with the amount of exactly 1 TRX, which means automated transfers were in action.

Prices dipped, then steadied

Crypto prices fell after the breach but later stabilized. Bitwise recorded declines of up to 5.0% for bitcoin and 6.1% for Ether. Still, it described trading as “sharp but orderly.” Bitcoin later climbed back above $77,000.

The recovery did little to stop customers from withdrawing funds. After withdrawals resumed, Binance recorded $4.72 billion in net outflows, even as $2.7 billion flowed back, Cryptopolitan reported. Its October 31 reserves snapshot showed at least one-to-one backing for ten major tokens. However, that snapshot is not a full solvency audit.

Where do investors keep crypto now?

The breach has also renewed questions about where investors should keep their crypto. In Cryptopolitan interviews, DeFi Technologies’ Andrew Forson favored exchange-traded products because investors have an institution to contact if something goes wrong. Septten Advisors’ Soham Jethani warned that regulation alone cannot eliminate the risks of keeping assets on an exchange.

Grayscale also made the case for institutional custody, although investors still face market and custodian risks.

Meanwhile, Binance says it is strengthening AI-based monitoring and commissioning independent security reviews. The real test is whether these measures can stop another attack before any funds are stolen.