Short description: Binance has disclosed how a months-long cyberattack involving fake recruitment interviews, compromised developer devices and an internal AI tool led to approximately $6.3 billion in cryptocurrency theft. The incident exposes critical weaknesses in employee security, wallet infrastructure and the growing intersection between artificial intelligence and cybercrime.
◉ A $6.3 billion theft followed a months-long infiltration campaign involving fake recruitment interviews, malicious software and compromised employee devices.
◉ Attackers reportedly exploited an internal AI tool to reach wallet developers and gain access to critical infrastructure.
◉ Binance says approximately 98% of affected assets have been replenished, while $2.85 billion has been frozen or intercepted.
The Human Entry Point
The Binance incident demonstrates how sophisticated cyberattacks can bypass conventional security systems by targeting the people operating them.
According to the exchange’s investigation, the operation began in June 2026, when an employee downloaded compromised software disguised as a legitimate developer tool. The attackers subsequently used a recruitment scam to compromise another engineer.
The fake recruitment process was carefully constructed. A supposed project director contacted an employee through a legitimate employment platform. After video interviews with individuals posing as company representatives, the engineer was instructed to download a coding assignment containing malicious software.
The compromised devices eventually provided access to employees responsible for wallet infrastructure.
This approach highlights a growing challenge for financial technology companies: cybersecurity is no longer exclusively about protecting servers, passwords and transaction systems. Recruitment procedures, developer environments and employee devices have become potential entry points.
AI as an Attack Vector
One of the most concerning elements was the reported use of Binance’s internal artificial intelligence tool.
On October 20, attackers allegedly used the compromised computer together with an internal AI tool to gain access to the systems of two wallet developers.
The incident raises important questions about how AI-enabled internal platforms interact with employee permissions, sensitive infrastructure and authentication controls.
AI tools can increase productivity by connecting information, executing workflows and assisting with technical operations. However, when compromised credentials or devices provide access to these environments, the same capabilities may become part of an attack chain.
Binance has not publicly disclosed every technical detail of how the internal AI tool was exploited. Therefore, the incident should not be interpreted as evidence that the AI system itself was independently breached.
Billions in Digital Assets
The attack culminated on October 29, when hackers used compromised credentials and malicious scripts to access wallet operations.
According to Binance, approximately $6.3 billion in cryptocurrency was stolen. The attackers exploited Ethereum’s EIP-7702 functionality to establish unauthorized execution permissions over a hot wallet.
The scale of the incident is particularly significant because it demonstrates how compromised operational access can undermine even sophisticated wallet-security arrangements.
Binance subsequently reported that approximately $2.85 billion had been frozen or intercepted. The exchange also stated that around 98% of affected assets had been replenished using company funds.
The FBI attributed the operation to North Korean-linked attackers. North Korea rejected the accusation.
A New Security Reality
The Binance incident has implications beyond the cryptocurrency industry.
Financial institutions, fintech companies, technology businesses and other organizations increasingly depend on interconnected employee devices, cloud infrastructure, AI assistants and automated operational systems.
The attack illustrates how weaknesses across several seemingly separate systems can combine into a single security failure.
The distinction between an external cyberattack and an internal security problem is becoming increasingly difficult to maintain. An attacker may never directly break through a company’s central infrastructure if they can first compromise a trusted employee and progressively move through authorized systems.
For cryptocurrency exchanges, the challenge is particularly significant: access to wallet infrastructure can translate into immediate and irreversible financial losses.
The next phase of digital asset security may therefore depend as much on controlling human access, AI permissions and developer environments as on protecting private keys and blockchain infrastructure.
The Recruitment Trap
