A fake recruitment process, malicious software disguised as a technical assignment and access to internal artificial intelligence tools reportedly helped North Korean hackers breach cryptocurrency exchange Binance and steal digital assets worth approximately $6.34 billion.

The attack, which involved unauthorised access to wallet-signing systems, took place on October 29, 2026. Binance’s investigation report, describes how the attackers spent months gathering information about the company’s employees and systems before exploiting an employee’s computer to gain access to internal infrastructure.

The incident highlights the growing cybersecurity risks facing cryptocurrency exchanges, particularly the danger of targeted recruitment scams that use seemingly legitimate job opportunities to compromise employees and corporate networks.

The Federal Bureau of Investigation (FBI) attributed the theft to North Korea. Binance said it had taken steps to replenish affected assets, freeze or intercept funds and strengthen its security systems.

Attackers reportedly spent months targeting employees

According to Binance’s investigation, the campaign began months before the October theft.

In June, an engineer downloaded a tampered Homebrew installation while setting up an AI coding tool. The compromised download contained malware that gave the attackers an opportunity to gather information about the company’s wallet team.

Binance detected the malware, replaced the affected device and rotated credentials. However, the attackers had apparently already collected information that helped them understand the organisation and identify potential targets.

The operation continued in September, when another engineer was approached through a job-hunting platform by an individual posing as a recruiter.

The supposed recruiter arranged video interviews and subsequently sent the employee a technical assignment. The assignment contained malware that had not been detected by the company’s earlier security measures.

By downloading and opening the compromised material, the employee unknowingly gave the attackers access to the computer. This provided another route into Binance’s internal systems.

The use of a fake recruitment process made the operation particularly concerning because it relied on an ordinary professional activity rather than an obvious attempt to break into a computer network.

How hackers exploited Binance’s internal AI tools

The attackers reportedly used their access to an employee’s computer to move deeper into the company’s infrastructure.

On October 20, they exploited an internal artificial intelligence tool to obtain access to a container deployment token. This helped them move towards systems associated with Binance’s wallet-signing services.

The attackers subsequently deployed a malicious container on October 29, gaining access to the internal wallet-signing service.

Wallet-signing systems play a critical role in cryptocurrency exchanges. They authorise transactions and help ensure that digital assets are transferred only through approved processes. Gaining access to such infrastructure can therefore create a serious security risk.

In this case, the attackers used the compromised access to initiate unauthorised transfers from five hot wallets.

Between 20:05 and 20:09 UTC, the wallets transferred approximately 233.46 million XRP to an address controlled by the attackers.

Other assets transferred included around 970,500 Solana (SOL), 44.2 million Optimism (OP) tokens and 18,270 Bitcoin (BTC).

The attackers also exploited Ethereum’s EIP-7702 authorisation mechanism to manipulate wallet permissions. A final unauthorised transfer of approximately 2,961.9 Ethereum (ETH) was completed at 23:56 UTC.

The scale and range of the transfers demonstrated how a compromise involving internal access and transaction authorisation systems could affect multiple cryptocurrency networks.

Binance says $2.85 billion was frozen or intercepted

Binance said approximately $2.85 billion worth of assets had been frozen or intercepted following the incident. The figure remains subject to reconciliation and market movements.

The exchange also said it had replenished 98% of the affected tokens by October 31 and had set aside more than the amount required to cover the losses.

The distinction between frozen or intercepted assets and replenished assets is important. Funds that have been frozen or intercepted are not necessarily the same as assets that have been recovered and returned. Replenishment refers to Binance using its own resources to restore the affected balances.

The exchange reiterated that customers would not bear the financial impact of the theft. It has committed to covering the losses rather than passing them on to users.

Binance had previously said it would use company resources to make good the affected assets. The latest update indicated that its replenishment efforts had advanced substantially within two days of the attack.

Security systems rebuilt after the breach

Following the incident, Binance said it had rebuilt the affected wallet system, replaced compromised devices and revoked credentials associated with the breach.

The company has also expanded behavioural monitoring to identify suspicious activity and detect unusual access patterns within its systems.

In addition, Binance is commissioning an independent security review to examine the incident and assess the effectiveness of its response.

The exchange’s investigation points to several potential weaknesses that organisations need to consider: compromised software downloads, targeted employee recruitment scams, access to internal development tools and the protection of systems responsible for authorising financial transactions.

The incident also illustrates why security measures cannot rely exclusively on detecting malware or protecting passwords. Attackers may combine social engineering with technical vulnerabilities and misuse legitimate internal tools after gaining access.

FBI attributes the attack to North Korea

The FBI attributed the Binance theft to North Korea, linking the operation to the country’s wider cyber activity targeting cryptocurrency platforms.

In an earlier statement, the bureau identified the North Korea-linked TraderTraitor group in connection with the theft of more than $6 billion in virtual assets from Binance. The agency also warned cryptocurrency businesses and other organisations to block transactions associated with identified attacker addresses.

The attribution adds to concerns about the use of cryptocurrency theft as a source of funds for illicit activities. North Korea has previously been linked by international authorities and cybersecurity researchers to several major cyber operations targeting financial institutions and digital-asset platforms.

Binance also said it had blocked 57 suspected North Korea-linked threats during 2026.

The exchange’s latest findings underline the importance of employee awareness, secure software installation, strict access controls and continuous monitoring of sensitive systems.

A warning for the wider cryptocurrency industry

The Binance incident is significant not only because of the reported value of the stolen assets but also because of the methods used to gain access.

A fake job opportunity provided the attackers with a route to an employee’s computer. Malicious software and access to internal tools then helped them reach systems responsible for authorising cryptocurrency transactions.

For exchanges and other technology companies, the case demonstrates that cybersecurity risks can emerge through routine workplace activities, including recruitment, software installation and the use of development tools.

As cryptocurrency platforms continue to expand their use of artificial intelligence and automated systems, protecting the access credentials and permissions associated with those tools will remain essential.

Binance has said it will absorb the financial impact of the breach and has taken steps to restore affected assets. The incident nevertheless raises broader questions about how digital-asset platforms can protect critical infrastructure against sophisticated, long-running attacks.