TL;DR: Binance published its own incident report on the $6.3 billion hack today, and it’s a lot more specific than anything the exchange has said so far. Attackers compromised one employee through a fake job interview, then used one of Binance’s own internal AI tools to pivot into the wallet infrastructure that eventually got drained. Binance says it’s frozen $2.85 billion of the stolen funds and replenished 98% of what customers lost, and that it detected 57 separate suspected North Korea-linked attack attempts in 2026 alone.
Binance has spent the better part of a week telling the crypto world how much money it’s gotten back. On Tuesday it switched gears and told people how the money got taken in the first place, and the answer is uncomfortable for every company running an AI coding assistant on an employee laptop.
A tampered install, then a fake recruiter
According to the report, the first crack in Binance’s defenses opened in June, months before the actual theft. A wallet DevOps engineer tried to install an AI coding tool and, in the process, pulled down a tampered version of Homebrew. Binance’s security team caught the anomaly, swapped out the device, and rotated the engineer’s credentials. That should have been the end of it. Instead, the attackers walked away with something almost as valuable as access: a clear picture of who worked on Binance’s wallet systems and who those people worked with.
They used that intelligence in September, running a fraudulent recruitment process against a second employee. Posing as hiring managers, the attackers sent over what looked like a normal technical assessment. It was a malicious coding assignment, and opening it handed over control of the employee’s work computer. This is the detail that’s going to get repeated in every security newsletter for the next month: a nation-state hacking crew got its foothold at one of the world’s largest exchanges through what amounted to a fake job offer.
The part Binance still won’t fully explain
From there the attack moved fast. On October 20, the attackers used that compromised machine, together with what Binance calls an “internal AI tool,” to take over two more engineers’ devices. One of those engineers had container deployment permissions. About nine days later, the attackers used the stolen credentials to deploy a container, run a malicious script, and get into the wallet-signing systems that let them authorize transactions without anyone’s approval. From there, more than $6.3 billion moved out the door.
What Binance has not said, in this report or anywhere else so far, is what that internal AI tool actually does or how exactly it got turned into a weapon against its own engineering team. For a company trying to set an example on disclosure, that’s a meaningful gap. Co-CEO Richard Teng framed the report as a lesson for the industry, posting that “this wasn’t one mistake or one breach, it was a months-long campaign,” and that the coordination behind it “could not be matched in traditional finance.” Fair enough, but an incident report that skips the one tool at the center of the lateral movement is still half an incident report.
Attribution, and a number that should worry every exchange
Binance says the FBI has linked the attack to North Korea, which lines up with what the bureau said when it pointed to the TraderTraitor group back on October 31st, as we covered when North Korea’s hackers moved $242 million through Tron in just 48 hours while the FBI’s own blocklist missed that chain entirely. North Korea’s government has publicly denied any role, calling the FBI’s claims a political provocation, so this is nowhere close to settled.
The number that should worry other crypto platforms isn’t the $6.3 billion. It’s the 57. That’s how many suspected North Korea-linked attack attempts Binance says it detected and stopped in 2026 alone, many of them using the same playbook of fraudulent interviews and malicious developer tools. Binance got unlucky, or under-defended, exactly once out of at least 58 tries this year. Every other exchange, exploit, and wallet provider is getting probed at a similar rate right now, and most of them don’t have Binance’s security budget.
Where the recovery stands
On the money itself, Binance says it has frozen or intercepted roughly $2.85 billion of the stolen assets and replenished 98% of what customers lost, continuing the recovery arc we tracked when Binance first said it had replaced 90% of the stolen funds and reopened withdrawals in phases. Withdrawals have kept expanding since then, with assets across BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron, and Base coming back online in order of user demand. Binance says hourly deposits are now outpacing withdrawals, which is the clearest sign yet that the panic phase of this hack is over even if the forensic phase isn’t.
Binance also says it’s commissioning an independent cybersecurity review, which is the right call and arguably overdue. Self-published incident reports from the victim are useful, but they’re not a substitute for an outside firm with no stake in how the story gets told.
Why the fake-interview playbook keeps working
None of this is new as a tactic. North Korean operators have been running fake recruiter and fake job interview scams against crypto and tech workers for years, usually to steal credentials or plant malware through a “skills test” the victim downloads and runs without a second thought. What’s different here is the scale of what one successful run bought the attackers, and how long it took to pay off. Five months passed between the first tampered Homebrew install in June and the wallet-signing compromise in late October. That’s not a smash-and-grab. That’s a patient, multi-stage operation that treated a single engineer’s inbox as the opening move in a campaign against infrastructure worth billions.
It also means the fix isn’t just “train employees to spot phishing.” Binance’s own security team caught the June intrusion and still lost the war in October, because the attackers simply moved to a different employee with a different pretext. Any company whose engineers interview candidates, review take-home assignments, or use AI coding tools on work devices is sitting on the same exposure Binance had, whether or not it manages six billion dollars in customer funds.
The bottom line
Give Binance credit for publishing specifics most companies would bury in a legal filing nobody reads. The fake job interview detail alone is worth the rest of the crypto industry pinning to the wall, because it’s not a crypto-specific attack vector, it’s a hiring-pipeline attack vector that works against any company with engineers who review take-home assignments. But a report that names the method and skips the tool is still doing some of the work of protecting Binance’s own reputation, not just informing the public. If the “internal AI tool” involved is something Binance sells or licenses to others, that omission stops being a minor gap and starts being the headline.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
