Binance's $6.3 Billion Hacked: A Four-Month Stealth Attack Leveraging Fake Recruitment and Internal AI Tools
Author: A Fox in Web3 Research Team
Compiled by TechFlow
TechFlow Guide: On October 29, 2026, the global cryptocurrency industry experienced the most significant security incident with the highest involved amount in history. In a matter of hours, hackers looted up to $63 billion in various token assets from Binance's hot wallets. This staggering scale is not only several times larger than the previous Bybit theft record, but also one of the largest single-incident cyber heists in terms of involved funds since the birth of the internet.
However, in stark contrast to the tragic fate of past major centralized exchanges facing run-on liquidation and years of restructuring after attacks, the entire industry has demonstrated unprecedented collaborative resilience in this storm. From real-time alerts by on-chain detectives, to Tether and Circle urgently freezing nearly $3 billion in stablecoins within tens of minutes, to top DeFi protocols like Aave decisively circuit-breaking to cut off money laundering channels, a global coordinated interception ultimately prevented hackers from taking away more than half of their loot.
More importantly, relying on its own SAFU fund and reserves, Binance fully covered 98% of the stolen exposure within days. The entire crypto secondary market not only avoided a stampede but instead absorbed the shock with remarkably calm price action. This article comprehensively reconstructs the details of this state-level cyber warfare involving fake interviews, novel malware, and abuse of internal AI tool permissions, providing an invaluable real-world snapshot for the industry to examine security infrastructure and defense depth.
Last Thursday, October 29, North Korean hackers stole approximately $6.3 billion in assets from Binance, the world's largest cryptocurrency exchange. This not only shattered the highest theft record in crypto history, but the involved amount is a full four times the amount stolen from Bybit in February of this year.
The hackers launched a meticulous four-month infiltration campaign. Through tampered download installers, meticulously crafted fake job interviews, and abuse of AI tools actively used inside Binance, they finally breached the defensive perimeter.
Within hours of the incident, stablecoin issuers such as Tether and Circle swiftly froze billions of dollars in stolen assets. Binance official statements indicated that it had fully replenished 98% of the stolen assets using its own capital.
So far, Binance platform users have suffered no financial losses, and secondary market prices across the crypto space have been barely affected. This fully demonstrates that the maturity and resilience of the entire crypto industry in responding to major security black swan events have come leaps and bounds.
This security breach targeting over $6 billion in assets at the Binance exchange last week is not only the largest theft in crypto history, but also highly likely the single-largest cyber heist in terms of involved funds across the entire history of the internet. This is a historic event destined to go down in records, despite its deeply distressing nature.
However, what is truly impressive is that numerous core industry participants, including Circle and Tether, reacted swiftly after the incident, decisively freezing vast amounts of stolen USDC and USDT. Binance further fronted all damaged assets in full within an extremely short timeframe, and the secondary market largely digested the impact based on price trends.
From multiple dimensions, this incident sharply reflects both the worst and the best aspects of the crypto world, which is precisely why I felt compelled to write this deep retrospective this week.
Binance Stole $6.3 Billion: The Largest-Scale Crypto Hacker Heist in History
Last Thursday, October 29, hundreds of millions of dollars in crypto assets began flowing out unpredictably from Binance's Hot Wallets. Hot wallets are typically kept constantly connected to the internet and serve as the core liquidity channel for major centralized exchanges to handle users' daily withdrawal requests in real time.
Within minutes of the abnormal activity, on-chain security analysts on the social platform X caught wind of the unusual capital flows. In less than an hour, the entire internet was convinced: Binance was under a massive hacker intrusion. Binance co-founder CZ was among the first core figures to publicly confirm this critical situation on social media.
Figure: CZ takes the lead on social platforms in publicly confirming Binance's hacker attack
According to subsequent loss statistics published by Binance officials, the total value of the stolen assets is approximately $6.34 billion, with the pilfered tokens spanning Bitcoin, Ethereum, Solana, Ripple, and several other mainstream blockchain public chains.
Valued in USD, this staggering figure unambiguously shatters the highest single-theft record in cryptocurrency history, roughly four times the $1.4 billion stolen from the Bybit exchange in February 2025.
The renowned on-chain data analytics platform Arkham quickly grouped the hacker-controlled on-chain addresses under a single entity tag. Data shows that on the day the attack was launched, over $5.7 billion in heavy funds quietly rested in 55 core addresses belonging to the hackers. As the hackers began frequently transferring and splitting funds on-chain, this number rapidly expanded across more than 10,000 derivative addresses.
Figure: Aggregate of hacker-related addresses and asset distribution aggregated on Arkham's on-chain tracking page
This Tuesday, Binance officially released a preliminary investigation report detailing the entirety of the intrusion incident. Binance issued a sincere apology at the outset of the report: “Such a severe incident should never have occurred. We offer our deepest apologies for the worry, disruption, and uncertainty brought to our vast user base, partners, and the entire industry.”
Figure: Preliminary investigation report and apology statement issued by Binance officials
Deconstructing the Modus Operandi: Four Months of Stealth, Fake Interviews, and AI Privilege Escalation Infiltration
This is an extremely meticulous and highly sophisticated targeted state-level cyberattack. No external hackers directly stole Binance's private keys; instead, the attackers spent a full four months methodically infiltrating Binance's internal network until they could manipulate Binance's proprietary internal systems to directly sign withdrawal transactions on their behalf.
Binance officials characterized this attack as “a highly complex, cross-stage joint infiltration operation,” and systematically outlined the four core key phases where the attackers succeeded:
Phase One (June): A core engineer responsible for Binance's wallet system accidentally downloaded a maliciously tampered counterfeit installer while searching online for a popular AI coding assistant tool. Although Binance's security protection team quickly flagged this anomaly and immediately replaced the engineer's work laptop with a brand new one, the attackers successfully used this opportunity to lock onto the engineer's critical functional role within the wallet team.
Phase Two (September): The hacker gang, posing as a director of a certain Web3 project on legitimate job recruitment websites, proactively identified and contacted a second Binance engineer. After completing video interviews with a fake HR recruiting representative and subsequently undergoing a second-round in-depth technical video interview with a fake CEO, this engineer was asked to download so-called “programming assignment test questions” on their work computer. Embedded within the test code was a completely new malicious trojan program never before seen in the wild, which successfully bypassed all endpoint security detection software deployed by Binance.
Phase Three (October 20): Using the infected work computer as a pivot, the attackers cleverly exploited an internal AI collaboration tool deployed within Binance, successfully horizontally penetrating and seizing control of two additional core engineers' workstations. During this process, the attackers searched for and stole a highly privileged access token, which granted them the privilege to freely launch and deploy software within the Binance system environment.
Phase Four (October 29): Leveraging these stolen high-risk privilege credentials, the hackers drove straight into the internal Signing Service nodes responsible for Binance withdrawal signatures, beginning to recklessly forge and sign illicit hot wallet withdrawal commands.
Using fake job recruitment and programming assignments for poisoning infiltration is a classic playbook that North Korean hacker gangs have relied on time and again. Binance officials revealed that within just this year alone, Binance's security team successfully intercepted 57 targeted attacks suspected to originate from North Korean hackers, with the vast majority employing methods identical to those in this case. The reason this particular attack ultimately succeeded is merely that the hackers maintained a sufficiently long stealth period and conducted continuous probing, eventually finding vulnerabilities in the systemic defense lines.
The actual asset theft operation commenced at 20:05 UTC on October 29. Five hot wallet addresses affiliated with Binance suddenly batch-transferred 233 million XRP to attacker addresses, immediately followed by large amounts of Solana, Optimism, and 18,270 bitcoins being rapidly looted.
On the Ethereum network, the hackers even cunningly exploited the newly introduced “EIP-7702” protocol feature from last year's Ethereum upgrade. This feature allows ordinary Ethereum Externally Owned Accounts (EOAs) to directly grant operational execution control of their accounts to specific smart contract code. Through the compromised Binance internal signing service, the attackers directly signed full control authorizations for their own deployed malicious contracts, thereby instantly seizing dominance over Binance's core hot wallets and swiftly emptying them.
This clever tactic made it extremely difficult for the Binance team to intercept on-chain after the incident. Even though Binance internally emergency-paused the withdrawal interfaces for the entire exchange, because the delegation authorization of EIP-7702 had already been permanently written into the underlying ledger of the Ethereum blockchain, attackers could bypass any of Binance's internal systems and directly invoke their own smart contracts to continue transferring funds on the public chain.
Furthermore, Binance's wallet security architecture universally employs Multi-Party Computation (MPC) technology. Under this architecture, wallet private keys are fragmented into multiple secret shares stored across different physical nodes, meaning no single individual or device can independently possess the complete private key.
In normal times, this is an excellent defensive design with substantial security redundancy; however, in extreme situations encountering sudden on-chain hijacking, it also meant that Binance could not quickly initiate an on-chain signature via any single private key to revoke the EIP-7702 delegation permissions. Binance's technical team had to hastily develop a complex specialized collaborative response script on an emergency basis, causing the final unauthorized illegal asset transfer to be completely blocked almost 4 hours after the attack broke out.
Rapid Lightning Interception by Multiple Parties: Stablecoin Issuers and DeFi Protocols Join Forces to Cut Off Flows
Of the massive $6.3 billion in stolen assets, nearly half consists of various stablecoins, including approximately $1.7 billion in USDT and $824 million in USDC. Unlike purely native crypto assets such as Bitcoin or Ethereum, these stablecoins are issued by centralized corporate entities Tether and Circle, possessing the technical capability to arbitrarily freeze tokens at designated on-chain addresses at the smart contract level. In this crisis, the response speed of these two issuing giants was exceptionally rapid.
About 40 minutes after the large-scale capital outflow began, Tether officials swiftly locked onto the hackers' primary receiving addresses and subsequently successfully froze the majority of the pilfered USDT assets.
Figure: Tether CEO Paolo Ardoino announces freezing USDT in hackers' receiving addresses
At the same time, Circle CEO Jeremy Allaire publicly announced that his team, “in close coordination with law enforcement agencies,” urgently froze 823 million USDC linked to the case.
Figure: Circle CEO Jeremy Allaire announces cooperation with law enforcement to freeze 823 million USDC
According to official Binance announcements, under the lightning-linked encirclement and interception by multiple parties, nearly $3 billion in stolen funds have currently been successfully frozen or intercepted en route. This means the funds that hackers could actually control and take away end up falling short of half of their initial stolen total.
Cunning hackers clearly foresaw the imminent risk of comprehensive stablecoin freezes. They engaged in a frantic race against time on-chain, attempting to swiftly swap stablecoins for Ethereum (ETH) on Uniswap, as there is no centralized entity at the Ethereum layer capable of imposing asset freezes. Hackers even deposited approximately $60 million in USDT into the top decentralized lending protocol Aave, trying to use it as collateral to borrow pure ETH.
Facing the hackers' collateral money laundering maneuvers, the Aave community and governance team rapidly made decisions to emergency-freeze their core lending markets, suspending all new deposit and borrowing functions while ensuring existing legitimate users could still freely withdraw and repay. Top lending protocol Kamino on the Solana chain also swiftly paused its relevant market trades out of prudent caution.
Figure: Aave officials announce emergency suspension of core lending markets to block hacker collateral borrowing
The centralized control granting Tether and Circle the power to salvage billions of dollars in assets during crises is precisely what crypto purists criticize the most in everyday times, as it implies that the assets of any ordinary user holding USDT or USDC theoretically face potential freezing possibilities. However, undeniably, in this thrilling asset interception battle this week, this centralized intervention power undoubtedly played a crucial positive market-saving role.
The Culprit Emerges: Money Laundering Chains of State-Level North Korean Hacker Gangs
On October 31, exactly two days after the attack broke out, the United States Federal Bureau of Investigation (FBI) officially released a cybersecurity alert, explicitly attributing this attack to a North Korean state-level hacker organization, specifically identifying the operatives behind the action as “TraderTraitor”. This hacker cell is precisely the mastermind behind the $1.4 billion Bybit heist planned earlier this year, and also serves as a core special operations branch under the more well-known North Korean hacker hub “Lazarus Group”.
Figure: FBI issues cybersecurity alert confirming North Korean hacker gang's involvement
In fact, a day before the FBI's formal announcement, top blockchain analytics firms TRM Labs and Chainalysis had already locked onto the fingerprints of the North Korean hackers through precise on-chain behavioral graphs. Chainalysis even keenly detected that the money laundering funds following another mainstream exchange, Bitget's $388 million hacker theft in September of this year, intersected and mixed on-chain with the capital flow stolen from Binance this time, strongly corroborating that these two vicious mega-cases were both the handiwork of the same syndicate.
Figure: Chainalysis monitoring reveals mixing of Binance stolen funds with September Bitget stolen funds
According to the latest investigative information from the FBI, attackers are currently going all out to centrally convert their remaining unfrozen diverse assets into ETH, planning to mix and launder coins through major DeFi protocols and instant swap services. In the Bybit case back then, this hacker gang leveraged the cross-chain decentralized swap protocol named Thorchain to gradually refine most stolen ETH into Bitcoin. Analysts predict they will very likely replicate similar money laundering chains this time.
The 18,270 bitcoins directly stolen in this heist are worth a total of approximately $1.4 billion. The hackers have distributed these bitcoins across 19 freshly generated independent on-chain addresses, where the vast majority happen to uniformly hold exactly 1,000 BTC each.
Given that Bitcoin's underlying architecture makes it absolutely impossible for anyone to forcibly freeze, hackers have begun mixing and laundering some of the converted bitcoins. Their core technique involves pooling together large amounts of bitcoins from different users via “CoinJoin” cross-participation transactions, thereby thoroughly obfuscating the original inflow and outflow paths of every fund.
TRM Labs expects the remaining stolen assets to shuttle sequentially between major cross-chain bridges, instant swap platforms, and Over-The-Counter (OTC) brokers; meanwhile, major on-chain security monitoring companies are continuously synchronously flagging implicated addresses to global compliant exchanges, doing everything possible to block any channel for hackers to cash out tokens into fiat currency.
History of Centralized Exchange Disasters: Evolution of Industry Defense and Self-Healing Capabilities
Lamentably, Binance was not the sole victim in this wave of hacker offensives. Within mere days of the Binance attack, attackers stole approximately $46 million in assets from Mercado Bitcoin, Brazil's largest crypto exchange; renowned on-chain detective ZachXBT also disclosed that an unnamed European crypto enterprise reportedly suffered a massive security loss exceeding $106 million.
Figure: Bankless reports on four other consecutive crypto security incidents occurring within days of the Binance case
Additionally, some merchants using outdated versions of BTCPay (a self-hosted Bitcoin payment suite) also faced fund theft, while dozens of Decentralized Finance (DeFi) frontend websites saw visitor wallets looted due to domain registrar hijacking.
Although there is currently no concrete evidence indicating direct technical links between these cases, the same emergency response plans once again saved the day: Tether swiftly froze funds related to the Mercado Bitcoin theft, and the exchange subsequently announced that its platform customers suffered no actual losses.
Looking back at the history of the crypto industry, exchanges suffering hacker raids is virtually a cruel evolutionary saga running through the sector's development:
In 2014, Beijing-based Mt. Gox lost approximately 650,000 to 850,000 bitcoins and declared bankruptcy, leaving tens of thousands of victim users waiting in despair for a full decade until 2024 when bankruptcy compensation payments finally began rolling in.
In 2016, the Bitfinex exchange lost about 120,000 bitcoins; the platform ultimately decided to execute a 36% indiscriminate mandatory proportional deduction (Haircut) on all user account balances, and issued a compensatory debt token named BFX.
In 2018, the Japanese Coincheck exchange was invaded, losing NEM tokens valued at approximately $530 million.
In 2019, Binance itself also lost 7,000 bitcoins in a serious security vulnerability breach.
In 2025, the Bybit exchange lost $1.4 billion, setting the industry's highest theft record prior to last week.
In the industry's early wild west days, even a hacker attack involving tens of millions of dollars often directly spelled out the total collapse of an exchange, delivering irreversible catastrophe to the general investing public. However, in this century-spanning storm involving up to $6.3 billion in this incident, Binance clearly announced it would fully bear all financial losses, funded by dedicated "SAFU" user asset safety funds, commercial insurance pools, and the platform's own robust financial reserves.
As of October 31, Binance official bulletins stated that 98% of the stolen assets had been fully fronted, and the platform's recharge and withdrawal channels for all currencies fully resumed normal operations on Sunday.
Figure: Binance CEO Richard Teng reports on full fund fronting and the recovery progress of deposit/withdrawal business
All reserve dynamics and the authenticity of asset redemptions can be publicly verified in real-time on Binance's open “Proof of Reserves” on-chain audit page.
Figure: Binance Proof of Reserves transparently displays real-time asset health status
Even more astonishing is that following the subsiding of the storm, Binance's overall capital flow not only avoided panicked mass withdrawals, but instead recorded substantial net capital inflows in the ensuing days.
Figure: Data shared by CZ shows platform funds did not experience a bank run post-incident, but rather saw net inflows
The performance of the entire crypto secondary market was equally unhurried to an unbelievable degree. Bitcoin's price only dipped slightly by less than 5% after the news broke, consistently holding steady above the critical $76,000 support line. Network-wide leverage liquidations triggered by panic amounted to merely around $1.5 billion, demonstrating the market's extraordinary absorption capacity compared to the devastating $19 billion liquidations during last year's "10/10 Flash Crash".
From my personal perspective, this past week sharply presented both the darkest and the most hopeful sides of the crypto world. The darkest side lies in the fact that a hacker legion backed by a state apparatus could devote four months to quietly infiltrating the internals of a top-tier global crypto exchange, pulling off the most massive, earthshaking heist in industry history with the largest involved funds, and subsequently triggering multiple follow-up attacks over the next few days.
While the most hopeful side is manifested in the shocking synergy and self-healing capacity across the industry following the crisis outbreak: on-chain detectives precisely solved the case and issued network-wide alerts within an hour; stablecoin giants thunderously froze billions in illicit funds; DeFi protocols proactively severed the hackers' cash-out retreat paths; law enforcement agencies pinpointed the perpetrators within two days; and the victim exchange completed a full, hundred-billion-level compensation fronting from its own pocket within just a few days.
Even after the storm passed, Binance voluntarily and exhaustively shared its complete technical post-mortem of the attack with the entire industry, profoundly stating: “Only if the entire industry jointly learns from these blood lessons can the overall defense system achieve true iterative upgrading.” Facing the increasingly swelling ambitions and attack tactics of state-level hackers like those from North Korea, the collective defense network and emergency response speed of the entire crypto world are also evolving synchronously at a remarkable pace.
Hacker attacks on centralized exchanges are a topic worn thin by repetition, yet that cryptic axiom tempered by years of testing has never grown obsolete: “Not your keys, not your coins”. While Binance can effortlessly weather the colossal loss of $6.3 billion thanks to its bottomless financial foundation, the vast majority of exchanges simply cannot withstand such a fatal blow. Precisely because of this, securely storing large assets in independent wallets where you solely control the private keys remains the most unshakable cornerstone for every crypto explorer navigating this treacherous world.
But most importantly, the crypto ecosystem has always advanced through the harsh tempering and fiery baptism of hackers since its inception, and each time it survives a storm, it becomes more impregnable than ever before.