Binance Details $6.34 Billion Security Breach Involving Fake Interviews and Compromised AI Tools

Cryptocurrency exchange Binance has disclosed details regarding an October 29 security breach that resulted in the theft of approximately $6.34 billion in digital assets. According to the company's latest incident update shared on X, the attack was a sophisticated, multi-stage campaign rather than a single isolated breach or a simple phishing incident.

Binance's investigation revealed that the attack began in September when an engineer was approached on a job-hunting platform by an individual posing as a project director. Following two rounds of interviews, the employee was instructed to download a malicious code repository disguised as an assignment onto a work computer. The malware utilized obfuscation and evasion techniques to avoid detection and established communication with an external server controlled by the attackers.

On October 20, the attackers leveraged the compromised computer along with an internal artificial intelligence tool to gain access to other employees. This allowed them to obtain credentials and permissions linked to the platform's wallet infrastructure. On October 29, the unauthorized access was used to reach Binance's internal wallet signing service, initiating transactions outside the normal withdrawal process.

Binance reported that approximately $6.34 billion in digital assets were impacted by the breach. As of its latest update, around $2.85 billion had been frozen or intercepted, subject to reconciliation and market price movements. The exchange stated it has set aside more than 100 per cent of the funds required to cover the losses. By October 31, 98 per cent of the affected token assets had been replenished, with the company purchasing the remaining less liquid assets.

"Our first responsibility is to protect users. Binance will absorb the financial impact of the stolen funds, not our users," the company stated.

Following the incident, Binance rebuilt the affected wallet system and internal AI tool, replaced compromised devices, revoked credentials, and strengthened wallet-service controls. The exchange is engaging independent cybersecurity firms for an assessment and increasing investments in AI-enabled detection, endpoint protection, developer-environment security, and behavioral anomaly monitoring.

Separately, the Federal Bureau of Investigation (FBI) attributed the attack to North Korea on Sunday, identifying it as the 'TraderTraitor' operation. The agency urged exchanges and virtual asset service providers to block transactions linked to the stolen funds. Binance confirmed that its investigation remains ongoing and its findings will be subject to further independent review.

"This incident highlights the evolving nature of cyber threats, where attackers are increasingly using social engineering tactics like fake interviews and compromising internal developer tools rather than relying on standard perimeter breaches. For businesses and technology platforms, this serves as a critical reminder that endpoint security and internal access controls must extend to recruitment processes and developer environments. Protecting modern digital infrastructure requires continuous behavioral monitoring and strict governance around AI tools and internal software repositories." — Dr. Shishir Gupta, Founder & CEO, StartupLanes