Binance says hackers used a fake job interview and its own internal AI tool to drain $6.3bn
Binance's initial findings trace the 29 October theft to a tampered AI coding tool download in June and a malicious interview repository in September; on 20 October the attackers used an internal AI tool to take over two wallet engineers' systems.
Why it matters
Binance published the report on Tuesday, five days after the 29 October theft that the FBI attributes to a North Korean group; North Korea rejects the claim. The exchange says about $6.34bn was affected, $2.85bn has been frozen or intercepted and user balances were 98% replenished. It says it has rebuilt the internal AI tool and its access controls, is increasing investment in AI-enabled detection and plans a security research fund with leading AI companies. It counted 57 attempts linked to North Korea this year.
Key facts
- About $6.34bn affected
- $2.85bn frozen or intercepted
- 98% of user balances replenished
- June: tampered AI coding tool download
- 20 Oct: internal AI tool used to take over engineers
- 57 North Korea-linked attempts in 2026