From a malicious search ad to a multi-round video recruitment interview drama, a group of hackers silently penetrated and took advantage of Binance's internal AI tool to steal 6.34 billion USD.

On November 3, 2026, the world's largest cryptocurrency exchange Binance officially announced a detailed technical investigation report on the attack that stole 6.34 billion USD (equivalent to 4.7 billion pounds) that occurred at the end of October 2026. Post-audit records show that the largest cryptocurrency theft in history did not start with superior password cracking techniques, but rather originated from a series of psychological traps aimed directly at the team of engineers operating the exchange's wallet infrastructure.

The intrusion campaign began in June 2026 when a Binance programmer accidentally downloaded a modified software installer through a malicious advertisement on the Google search engine. Although Binance's security system first detected the malware and replaced this employee with a new computer, the spyware had previously collected the role diagram and working methods of the entire team of engineers in charge of the cryptocurrency wallet infrastructure.

Knowing the list of target personnel, in September 2026, a person pretending to be a project director proactively approached a second engineer in the team through a legitimate recruitment platform. The attack team patiently set up multiple rounds of realistic interviews, including a video interview with a fake human resources representative and a second interview via messaging app with someone claiming to be the chief executive officer (CEO) of a fake company. Once complete trust was established, the impostor sent the male engineer a technical test exercise that was actually a previously unknown (0-day) vulnerability malware.

The malware bypassed all endpoint protection software at the time by deleting the legitimate pyenv programming management tool executable and replacing it with a fake version, opening a hidden connection to the remote server and automatically erasing traces of the intrusion.

The most dangerous turning point takes place on October 20, 2026. From the second engineer's infected computer, the hacker group - identified by the US Federal Bureau of Investigation (FBI) as the TraderTraitor cyberattack unit linked to North Korea - took advantage of an internal Binance AI tool to extend control over the wallet management system of the first engineer and a third wallet developer in the same department. On October 29, 2026, the attacker logged into the third developer's computer with stolen credentials and activated a malicious script to mass withdraw funds from hot wallets.

Explaining that it took nearly two hours to completely prevent illegal money transfers, Binance said that because the hot wallet system uses multi-party computing technology (Multi-Party Computation - MPC), the exchange does not have a single personal security key to be able to immediately revoke malicious authorization orders according to the EIP-7702 standard.

Binance co-CEO Richard Teng confirmed that the exchange has blocked or frozen about 2.85 billion USD out of a total of 6.34 billion USD withdrawn from wallets. As of November 3, 2026, Binance has compensated 98% of the affected tokens from its reserve fund so that users do not suffer losses and restore normal withdrawal operations. While the FBI blamed the attack on Pyongyang on October 31, 2026, the Korean Central News Agency (KCNA) on November 3, 2026 quoted Ms. Kim Yo-jong denying the accusations and calling these baseless allegations.