Binance has revealed new details about the massive $6.3 billion cryptocurrency hack that struck the exchange on October 29, 2026. According to the company’s investigation, attackers spent several months compromising employee computers, stealing credentials and exploiting internal systems before gaining access to its digital asset wallets.
The sophisticated cyberattack involved fraudulent job interviews, malicious software and a compromised internal artificial intelligence tool.
The incident, considered the largest cryptocurrency theft on record, has raised serious concerns about cybersecurity vulnerabilities at major crypto exchanges and the growing sophistication of attacks targeting their employees.
Binance Hack Began With Malicious Software in June
According to Binance’s security investigation, the attackers began preparing their operation in June 2026.
The initial breach occurred when a software engineer working on the exchange’s wallet infrastructure downloaded a compromised software package while attempting to install an AI coding tool.
The malicious installation exposed information about the employee and colleagues involved in Binance’s wallet operations.
Although the exchange’s security team detected the suspicious activity, replaced the affected computer and updated related credentials, the attackers had already obtained valuable information.
This early compromise helped establish the foundation for a broader campaign targeting Binance’s internal systems.
Rather than relying on a single vulnerability, the attackers gradually combined multiple techniques to expand their access to critical infrastructure.
Fake Job Interviews Helped Hackers Compromise Binance Employees
The attackers launched another phase of their operation in September, using fraudulent recruitment interviews to target a second Binance software engineer.
Posing as representatives of a legitimate company, they approached the employee through a professional job platform.
The victim participated in what appeared to be a normal recruitment process involving interviews and communication with supposed company executives.
However, the recruitment opportunity was part of an elaborate social engineering scheme.
During the process, the attackers persuaded the employee to download a coding assignment containing malicious software.
Once installed on the engineer’s work computer, the malware allowed the attackers to establish unauthorized access.
The malicious program also used advanced techniques to avoid detection by the exchange’s security systems.
As a result, the attackers were able to maintain access while continuing preparations for the larger breach.
Compromised AI Tool Expanded Access to Binance Wallet Systems
On October 20, the hackers moved further into Binance’s internal network.
Using the previously compromised employee computer and an internal AI tool, the attackers gained access to the systems of two additional engineers.
One of those devices contained deployment credentials that could be used to introduce software into the exchange’s wallet infrastructure.
The stolen credentials became a critical part of the attack.
On October 29, the hackers exploited this access to deploy malicious software and reach Binance’s internal wallet-signing service.
This service is responsible for authorizing cryptocurrency transactions.
By compromising the signing infrastructure, the attackers gained the ability to initiate unauthorized transfers outside the exchange’s normal withdrawal procedures.
The findings suggest that the AI tool served as an entry point for expanding the attack rather than independently carrying out the theft.
Hackers Exploit Ethereum EIP-7702 to Continue Crypto Transfers
The attackers also exploited Ethereum’s EIP-7702 authorization mechanism during the Binance hack.
EIP-7702 allows cryptocurrency accounts to delegate certain transaction permissions to smart contracts.
According to Binance, the hackers used this feature to grant an attacker-controlled smart contract execution rights over one of the exchange’s hot wallets.
These permissions enabled unauthorized transactions to continue even after Binance suspended withdrawals.
The situation became more complicated because the affected wallets relied on multiparty computation (MPC) technology.
MPC distributes control over transaction signing rather than depending on a single private key.
Although this design provides important security benefits, it complicated the emergency process of revoking the malicious permissions.
Binance eventually developed a specialized procedure to remove the unauthorized authorizations and regain control over the affected wallet infrastructure.
The exchange reported that the final unauthorized transfer was completed on October 29, with the relevant malicious delegation cleared shortly after midnight on October 30.
Binance Freezes $2.85 Billion and Pledges to Cover Customer Losses
The cyberattack affected approximately $6.34 billion in digital assets, according to Binance’s latest accounting.
The exchange reported that roughly $2.85 billion had been frozen or intercepted through coordination with blockchain networks, token issuers and other industry participants.
However, freezing stolen cryptocurrency does not necessarily mean those assets have already been recovered.
Binance has pledged to absorb the financial impact of the incident rather than pass the losses on to customers.
The company said it had allocated sufficient resources to cover the affected assets using its own reserves and customer protection arrangements.
As of October 31, Binance reported replenishing approximately 98% of the affected token assets.
The remaining assets, including some less liquid cryptocurrencies, were still being acquired.
The exchange also announced additional security improvements, including replacing compromised devices, rebuilding affected systems and strengthening controls over employee credentials.
FBI Links $6.3 Billion Binance Hack to North Korean Cybercriminals
The Federal Bureau of Investigation (FBI) has attributed the cryptocurrency theft to North Korean hackers.
The agency identified the operation as connected to TraderTraitor, a cybercrime group previously associated with major cryptocurrency thefts.
The attribution has drawn international attention because of longstanding concerns about state-linked hacking operations targeting digital asset platforms.
However, North Korea has denied responsibility for the Binance attack.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, rejected the FBI’s allegations and accused Washington of using the incident to damage the country’s international reputation.
The competing statements highlight the political sensitivity surrounding the investigation.
Meanwhile, cybersecurity specialists and law enforcement authorities continue examining the movement of the stolen digital assets.
Binance Says It Blocked 57 Cyber Threats During 2026
The exchange’s security investigation also revealed the scale of attempted cyberattacks targeting its operations.
Binance reported detecting and preventing 57 suspected North Korea-linked security threats during 2026.
These incidents reportedly included fraudulent recruitment schemes, compromised software packages and attempts to steal employee credentials.
Other techniques involved malicious browser extensions, fake communication applications and software designed to install unauthorized remote access tools.
Binance co-founder Yi He acknowledged the seriousness of the October breach despite the company’s success in preventing other attempted attacks.
The exchange has since committed to additional cybersecurity investment, including stronger employee-device protections, improved monitoring systems and independent security assessments.
Binance also plans to work more closely with technology companies and cybersecurity specialists to address emerging threats involving artificial intelligence and digital asset infrastructure.
What the Binance Hack Means for Crypto Exchange Security
The $6.3 billion Binance hack demonstrates how sophisticated cyberattacks can exploit weaknesses beyond traditional cryptocurrency wallet protections.
Instead of relying exclusively on blockchain vulnerabilities, the attackers reportedly targeted employees and internal development systems over several months.
The combination of social engineering, compromised software, stolen credentials and unauthorized transaction permissions ultimately allowed the hackers to penetrate critical infrastructure.
The incident also highlights the risks associated with increasingly complex software environments, including AI-assisted development tools.
For cryptocurrency exchanges, stronger wallet protections alone may not be sufficient if attackers can compromise the employees and systems responsible for managing those wallets.
Continuous monitoring, strict access controls and secure software development practices will remain essential components of cryptocurrency security.
Although Binance has pledged to cover customer losses and strengthen its defenses, the unprecedented scale of the theft underscores the challenges facing the broader digital asset industry.
