Binance reports $6.3 billion theft linked to AI tools and fake job interviews

Binance co-CEO Richard Teng confirmed that a cyberattack on October 29 resulted in the theft of over $6 billion in assets from the exchange’s wallet infrastructure. The attackers reportedly spent months gaining access by deploying a combination of malicious software and social engineering, including posing as recruiters to target engineers.

According to the company, the breach began in June when an engineer was lured into installing a compromised AI coding tool. By September, attackers engaged staff in fake job interviews, using coding exercises to introduce malware that bypassed security protocols. This eventually allowed the hackers to breach the system responsible for authorizing wallet transactions. Teng rejected the notion that the breach was caused by a single point of failure, describing it instead as a sophisticated, long-term infiltration.

Binance has since replenished 98% of the stolen assets using its own reserves and reports that it is working with industry partners to freeze remaining funds. While the FBI has linked the attack to North Korean actors, Binance has initiated an independent security audit to overhaul its defenses and restore market confidence.

The incident serves as a significant security test for centralized exchanges. Binance continues to decommission affected credentials and expand security scans across its infrastructure to prevent further unauthorized access.