Binance Hack Explained: How Job Interview Phishing Led to a $6.34 Billion Crypto Heist

TL;DR — On 29 October 2026, attackers moved about $6.34 billion out of Binance hot wallets, the largest crypto theft on record. Binance says it began with recruitment phishing and a poisoned software install, not an attack on its perimeter.

• June: a wallet engineer installed a tampered Homebrew while setting up an AI coding tool. Binance cleaned it up, but the attackers had already mapped his team.
• September: a fake "Project Director" on a job platform led a second engineer through two interviews to a malicious coding assignment. It swapped pyenv for undetected malware.
• By 20 October: through that laptop and an internal Binance AI tool, the attackers took over two more engineers and found a container deployment token.
• 29 October: they reached the wallet signing service. An EIP-7702 delegation kept the Ethereum drain going after withdrawals were paused.
• Money: about $2.85 billion frozen or intercepted. Binance replaced 98% of the stolen tokens from its own funds.
• Attribution: the FBI blames North Korea's TraderTraitor. North Korea denies it.

About this article. This is an analysis of public sources, not PhishEye incident-response work. We had no access to Binance's systems or the malware, and we publish no indicators of compromise. The attack chain comes from Binance's incident report of 3 November 2026; on-chain figures from TRM Labs, Chainalysis, Elliptic and Fireblocks; the attribution from the FBI's alert of 31 October. Where sources disagree, we show both figures and whose they are. Current as of 4 November 2026.

The theft lasted a few hours. It took four months to set up, and it began with a job offer.

According to Binance, nobody broke through its firewall, cracked a private key or found a bug in a smart contract. The attackers went after engineers. They poisoned one engineer's software install, then courted another with a job interview. They waited until they had a foothold on the laptops of the people who build and run Binance's wallets. When they finally moved, they used Binance's own signing service to approve the transfers.

This matters well beyond crypto. Almost every company has developers who install tools from the internet, post their employer on a professional profile, and keep deployment tokens on their laptops. A growing number also give those developers internal AI assistants that can reach other systems. The Binance report shows what a patient attacker can do with all four.

The lesson for defenders is uncomfortable but simple. Attackers do not need to break through the perimeter when they can persuade a trusted person to run their code inside it.

Binance hack explained: what happened and how much was stolen

Between roughly 20:05 UTC and 23:56 UTC on Thursday 29 October 2026, Binance hot wallets on about ten blockchains sent their balances to addresses the attacker controlled. Blockchain analytics firm TRM Labs estimated the total at $6.36 billion and said most of it moved in about 20 minutes. Binance puts the impact at about $6.34 billion. Chainalysis estimated about $6.4 billion and Elliptic $6.43 billion. The differences come mostly from token prices at the time each firm counted.

That night Binance suspended withdrawals and asked stablecoin issuers and exchanges to freeze affected tokens. Its first statements said an engineer's compromised laptop looked like the starting point. It then said it had found further "points of breach" and no evidence that any wallet private key had leaked. Co-CEO Richard Teng said the attacker had not simply used one engineer's permissions.

The full chain came out on 3 November in Binance's initial incident report. It describes three engineers, two separate initial compromises and one internal AI tool. That tool helped the attackers move from a developer's laptop to the systems that authorise transfers out of Binance's hot wallets.

Binance says customers will not bear the loss. It set aside more than $6.34 billion of company funds and replaced most of the stolen tokens within days. Withdrawals reopened in stages, and The Block reported a phased restart from 04:00 UTC on 3 November across chains including BSC, Ethereum, Solana, XRP, TRON and Base.

Binance hack timeline: from the first compromise to the crypto heist

Binance's report names three people by role: Wallet DevOps Engineer A, Software Engineer B and Wallet Software Engineer C. Two things have to be kept apart: the June compromise of Engineer A and the September compromise of Engineer B. They were separate incidents with different lures. Binance caught the first and missed the second.

June 2026: the first compromised developer

In June, Engineer A, who works on wallet operations, wanted to install a popular AI coding tool. Binance has not named the tool. The setup needed Homebrew, the standard package manager for macOS. According to Fortune's reading of the report, he reached the download through an internet ad rather than through Binance's internal software channels, and installed a tampered copy of Homebrew.

Binance's security team noticed the anomaly. It replaced Engineer A's device and rotated the credentials tied to it. By Binance's own account, that was not enough. Before they were cut off, the attackers had learned Engineer A's role and the names of colleagues around him on the wallet team. Binance's report implies that this map shaped the rest of the operation, but does not say so directly.

Fake Homebrew is not a new lure. In January 2025, BleepingComputer reported Google ads that displayed Homebrew's real address, brew.sh, but sent visitors to a lookalike site. That site told them to paste a Terminal command that installed the Atomic macOS Stealer, the same stealer we found behind a fake DirBuster download. Similar ad-driven fake Homebrew pages were reported again in October 2025 and March 2026. It works because installing Homebrew legitimately means copying a one-line curl … | bash command from a web page and running it with your own privileges. A malicious copy looks exactly the same to the person typing it.

The ads themselves can look official. In the example below, a sponsored result for the search "homebrew" shows business.google.com as its address, not Homebrew's own site.

Two things make developer tooling a strong entry point:

• Developers are expected to run code from the internet. Package managers, version managers, SDKs and AI coding assistants all install the same way: download, run, grant permissions. A security control that blocked this would block the job.
• Developer machines hold the keys. Cloud credentials, SSH keys, API tokens, deployment tokens and session cookies for internal tools often sit on a developer's laptop. Compromise the laptop and you inherit what its owner can reach.

September 2026: the fake job interview (recruitment phishing)

The second compromise was slower and far more personal.

In September, Software Engineer B was contacted on what Binance calls a legitimate job-hunting platform. Fortune reported it as LinkedIn. His profile on the platform referred to his experience at Binance. The approach came from someone posing as a Project Director at a company that does not exist.

This is recruitment phishing: spear-phishing delivered through a job platform and a chat app instead of email, with a fake employer instead of a fake login page. MITRE ATT&CK files it under Phishing: Spearphishing via Service. What followed was a recruitment process built to feel real:

1. A first-round interview over live video with a person presenting as an HR representative. To build trust, that person shared a social media account full of personal photos and videos. Binance described this as more advanced and deceptive than the social engineering it had seen before.
2. A second-round interview on a popular chat app with a man claiming to be the fictitious company's CEO. Binance has not named the app.
3. A take-home coding assignment. The "CEO" asked Engineer B to download the assignment from an online code repository and run it. He did so on his work computer.

Fortune reported that the scheme ran over months. A Binance spokesperson told Fortune that employees in non-public-facing roles may not keep LinkedIn profiles. The spokesperson would not say whether Engineer B had broken that rule.

Finding people like Engineer B takes one search. Anyone with a LinkedIn account can search for a job title and filter by current employer. The results list engineers who name the company and describe their role, and offer a Message button next to each one.

Each step answers a doubt a careful engineer might have. A recruiter on a mainstream job platform is normal. A live video call with a real face is reassuring. A personal social media history makes it feel like a person, not a persona. Interviewing with the CEO feels like progress. A coding test is the most ordinary request in tech hiring. Running it is what candidates are expected to do.

This is the same structure security researchers have documented in North Korea-linked campaigns for years. Lazarus Group's Operation Dream Job sent fake job documents laced with malware. The Contagious Interview campaign sends candidates coding tests that pull in malicious packages. Socket documented 35 such npm packages in June 2025. The FBI's September 2024 public service announcement (I-090324-PSA) warned that North Korean actors research crypto employees through their professional profiles and impersonate recruiters and investors. It also named the warning sign that matters most here: a request to run code or install software on a company device during a hiring process.

What the coding assignment did

Binance published more about the malware than about any other stage. According to its report, as quoted by BleepingComputer and TheStreet:

• A script in the assignment created a replacement executable named pyenv_ inside the macOS Homebrew installation directory.
• It deleted the legitimate pyenv binary. pyenv is a widely used tool for switching between Python versions.
• It renamed the malicious file to pyenv and modified the symbolic link that pointed to it.
• The fake pyenv spawned a Z shell (zsh) process and ran commands sent from an attacker-controlled server.
• It concealed its own traces. Binance called it 0-day malware that its endpoint security tools did not detect at the time.

This is a quiet form of persistence. It does not need a new launch agent, a login item or anything else an endpoint product typically watches. It replaces something the developer already runs every day, inside a directory owned by that user, with a binary of the same name. Every time a terminal, an IDE or a build script calls pyenv, the attacker's code runs with the engineer's privileges. To the engineer, nothing looks wrong.

Binance has not published a malware family name, hashes, the command-and-control address, the repository or the fictitious company's name. It says some details will stay private so other attackers cannot reuse them. We have not invented any of them here.

After the infection, the attackers waited.

October 20, 2026: the "Binance AI hack" and lateral movement

By 20 October, the attackers had used Engineer B's compromised computer and an internal Binance AI tool to take control of two more devices. One belonged to Engineer A, the wallet DevOps engineer from June, now on a replacement laptop. The other belonged to Wallet Software Engineer C. On Engineer A's device they found a container deployment permission token, a credential that allows its holder to deploy software into Binance's systems.

This is the part of the report that has drawn the most attention, and the part with the fewest public details. Binance has not said:

• what the internal AI tool is, or which model or vendor it uses;
• what access the tool had, or what permissions it ran with;
• whether the attackers used it to run commands, to read data, to send messages that looked like they came from a colleague, or for something else.

No public source says a commercial AI model was compromised or misbehaved. The reporting supports one narrower statement: an AI tool inside Binance's environment gave an attacker on one engineer's laptop a path to other engineers' machines. Binance has since rebuilt the tool. Separately, Elliptic told CoinDesk that the laundering showed signs of automation but that it had found no evidence AI agents were directing the transactions.

Our analysis, not Binance's finding. Internal AI assistants are often given broad access precisely so they can be useful: to code repositories, to ticketing and chat, to cloud consoles, sometimes to the ability to run actions on behalf of a user. From an attacker's point of view, a tool like that is a ready-made bridge between systems that would otherwise be separate. It also produces activity that looks routine because it comes from a trusted service. Until Binance publishes more, treat this as a warning about scope and identity: what an internal AI tool can reach, whose authority it acts with, and whether anyone would notice if it were driven by someone else.

October 29, 2026: the attack on wallet signing

The theft itself took one evening. The timings below are UTC and come from Binance's report as relayed by TheStreet, and from on-chain analysis by TRM Labs and Fireblocks.

• 17:15. The attackers log into Engineer C's computer.
• 17:15 to 19:56. Working inside Binance's systems, they use Engineer A's stolen credentials to deploy a container and run a malicious script against the internal wallet signing service, the system that approves transactions leaving Binance's hot wallets. This lets them start transfers outside the normal withdrawal process.
• 20:05 to 20:09. Five Binance hot wallets send about 233.46 million XRP to an attacker address.
• Next. About 970,500 SOL and 44.2 million OP leave Binance hot wallets. An internal alert on unusually large transfers triggers an investigation.
• Then. About 18,270 BTC leaves another hot wallet.
• 20:20. On Ethereum, a single transaction carries 50 EIP-7702 authorizations signed with the key of the hot wallet Fireblocks labels "Binance 14". About three minutes later, 167,464 ETH and 63 tokens, including about 1.6 billion USDT, leave that wallet (TRM Labs).
• Through the evening. Binance suspends withdrawals and asks partners to freeze tokens. Ethereum outflows continue through the delegation.
• 23:56. A last, earlier-queued transfer of about 2,962 ETH goes through.
• About 00:10 on 30 October. Binance clears the attacker's delegation from the Binance 14 wallet. Nothing leaves after that.

Two details stand out. The attackers did not need Binance's private keys. They needed a system that holds signing authority to agree to sign, and the stolen deployment token let them put their own code next to it. And Binance's alerting worked: large transfers raised an alarm within minutes. But an alarm cannot recall a confirmed blockchain transaction. By the time people were looking, billions had already moved.

How EIP-7702 kept the drain going after withdrawals stopped

EIP-7702 arrived on Ethereum mainnet with the Pectra upgrade in May 2025. It lets an ordinary account, called an externally owned account or EOA, set a delegation: a signed authorization saying "when this account is called, run the code at this contract address". It is designed to give normal wallets smart-contract features such as batched transactions and sponsored gas.

The attackers used it differently. Here is what the public analysis shows:

• The authorization was signed with the hot wallet's own key, through the compromised signing service. Binance's hot wallets use multi-party computation (MPC), so no single private key exists to steal. The signing system itself produced a valid signature.
• They submitted 50 authorizations at once. An EIP-7702 authorization includes the account's nonce, a counter that must match exactly. Fireblocks said the attackers included 50 so that at least one would be valid. Bitcoin.com described it as manipulating the account's transaction sequence. Either way, one valid authorization was enough.
• The delegation pointed to an attacker contract that sweeps funds. Once set, the attacker could move the wallet's assets through that contract without asking Binance's signing system for each transfer.
• Suspending withdrawals did not remove it. The delegation lived on-chain, outside Binance's systems. Turning off Binance's withdrawal pipeline stopped new signed withdrawals. It did not revoke code already attached to the account.
• Revoking it under MPC took time. Clearing a delegation means signing a new authorization from the same account. With MPC, Binance had to build a special procedure to do that, which is why the delegation was not cleared until about 00:10 UTC on 30 October.

Is EIP-7702 to blame? Most of the experts Cointelegraph spoke to said no. Blockaid's Ido Ben-Natan said compromised signing systems were the root cause, and that EIP-7702 let the attackers act "in one sweep" and possibly skip some checks. Ambire's Ivo Georgiev said it made little difference, because an attacker who can authorise transactions can already move funds. He did warn that teams may not think to revoke a malicious delegation, calling the standard poorly understood. On the other nine or so chains, funds left through ordinary signed transactions that have nothing to do with EIP-7702.

The fair reading: EIP-7702 did not open the door, but it gave the attacker a way to keep it open after Binance tried to shut it. For any team that operates Ethereum hot wallets, "how do we revoke a delegation, quickly, under our signing scheme" now belongs in the incident runbook.

Stolen, frozen, intercepted, replenished: what the numbers mean

The headline numbers measure different things. Several early reports mixed them up.

• Stolen ($6.34 billion, per Binance). The value of assets that left Binance's wallets without authorisation, priced around the time of the theft. Other estimates range up to $6.43 billion, depending on the pricing source and time.
• Frozen. Tokens that are still in the attacker's addresses but can no longer move, because the issuer has used its own controls. Centralised stablecoins such as USDT (Tether) and USDC (Circle) can be frozen this way. Native coins like BTC and ETH cannot. Frozen is not the same as recovered. Getting the value back usually needs a legal process or the issuer's cooperation.
• Intercepted. Funds stopped on the way out, for example when exchanges or services block deposits from known theft addresses and hold them.
• Frozen or intercepted ($2.85 billion). Binance's figure for both together, as of 3 November. Elliptic gives the same number, about 44% of the total, and says about $3.24 billion was still in addresses linked to the theft, mostly BTC and ETH. Fortune reported about $2.5 billion recovered through Tether and Circle freezes. Early figures near $3 billion came before reconciliation. Binance warns the number will move with reconciliation and prices.
• Replenished (98%). The share of affected token holdings that Binance had replaced from its own funds by 31 October, so that customer balances are fully backed. This is Binance spending its own money. The stolen funds have not come back. Binance said it was still buying the remaining 2%, mostly less-traded assets.

Put simply: customers are covered because Binance paid, not because the money was recovered. Of the stolen value, a large minority is frozen, and the rest remains with the attacker. Elliptic reported that the attacker used about 12,000 wallets and more than 40,000 transactions in the first four days, and spread funds across some 7,700 TRON addresses. It also used decentralised exchanges to swap freezable stablecoins into ETH before issuers could act, about $786 million of it. Elliptic expects a slower cash-out over months than after the 2025 Bybit theft.

Who hacked Binance? North Korea, TraderTraitor and Lazarus

TraderTraitor and Lazarus. TraderTraitor is the name US agencies use for a North Korean state-backed cluster focused on stealing cryptocurrency. It is also tracked as Jade Sleet and Slow Pisces, and is usually treated as part of the wider Lazarus Group umbrella, alongside APT38. CISA, the FBI and the US Treasury described TraderTraitor's trojanised crypto apps and job-themed lures in a joint advisory in April 2022 (AA22-108A).

The FBI's position. On 31 October, the FBI said North Korea was responsible for the theft of more than $6 billion from Binance on or about 29 October. It named the operation TraderTraitor, the same cluster it blamed for the $1.5 billion Bybit theft in February 2025. Working with the US Secret Service and IRS Criminal Investigation, the FBI said the thieves were mainly converting assets into ETH and would launder them through DeFi platforms and fast-swap services. It published addresses it says are controlled by or connected to North Korean actors, and asked exchanges and other virtual asset service providers to block them. The FBI has not released its full forensic findings.

Private-sector attribution. TRM Labs attributed the theft to TraderTraitor "with high confidence" on 29 and 30 October, citing similarities with earlier North Korea-linked heists including Bybit. Chainalysis said the hack was likely TraderTraitor's work, based on funds mixing with proceeds from an earlier theft. Elliptic said its own on-chain analysis supports the FBI's attribution.

Binance's position. Binance's report describes the techniques but, according to BleepingComputer, does not tie the employee compromise to a specific known campaign. Binance refers to the FBI's conclusion. It also says it detected and stopped 57 suspected North Korea-linked attacks against it in 2026, many using fake interviews, fake video-call apps and malicious developer tools.

North Korea's response. In a statement carried by the state news agency KCNA, Kim Yo Jong, sister of leader Kim Jong Un, rejected the accusation. CNBC reported that she called it a grave political provocation. CoinDesk quoted her saying the FBI was trying to brand the country a "cyber criminal state". She also disputed the FBI's Bybit attribution.

How strong is the evidence? The FBI, three independent blockchain analytics firms and the tradecraft all point the same way. Fake recruiters, staged interviews, malicious coding tests, macOS developer tooling and attacks on signing infrastructure are all documented TraderTraitor and Lazarus patterns. But the public case rests mainly on on-chain links and on the FBI's word. The underlying intelligence has not been published, and North Korea denies it. The accurate description is: attributed by the FBI to North Korea's TraderTraitor, supported by private-sector analysis, denied by Pyongyang.

Binance hack vs Bybit hack: the same playbook, four times the size

Until 29 October, the record was the theft of about $1.5 billion in ETH from Bybit on 21 February 2025. The FBI attributed that one to TraderTraitor too. The two incidents are worth comparing, because both began with a developer's machine and neither needed a stolen private key.

The lesson carries over: the target is now the system or person that approves a transaction, not the key that signs it. Bybit's attackers fooled the humans reviewing the signature. Binance's attackers skipped the humans and drove the signing system directly.

Binance hack latest updates

Status as of 4 November 2026. We will update this section as Binance, the FBI and investigators publish more.

• Withdrawals. Suspended on 29 October and reopened in stages. The Block reported a phased restart from 04:00 UTC on 3 November across chains including BSC, Ethereum, Solana, XRP, TRON and Base.
• Customer funds. Binance says customers will not bear the loss. It set aside more than $6.34 billion and had replaced 98% of the affected tokens by 31 October. It was still buying the remaining 2%.
• Frozen funds. About $2.85 billion frozen or intercepted, according to Binance and Elliptic. The rest is being laundered across thousands of wallets.
• Investigation. Binance published its initial incident report on 3 November. It is commissioning an independent cybersecurity review and says independent firms are checking its findings.
• Attribution. The FBI named TraderTraitor on 31 October. North Korea denied it in a KCNA statement from Kim Yo Jong on 2 to 3 November.
• What CZ said. Binance founder Changpeng Zhao posted on the night of the theft that user funds were safe. After the report, he said there is no such thing as 100% security and that users had not lost money.

After the hack: fake compensation phishing and engineered panic on X

The theft was only the first wave. Within hours, Binance's name was being used to phish its own users, and the conversation on X was being pushed toward a bank run.

The most detailed public look at this is an independent analysis published on X by the researcher Ape (@immrape): Engineered Panic: 78 hours, 1,083 accounts, 11,700 tweets, the second front after the Binance hack (November 2026). The author used AI-assisted scanning to sample X accounts that posted false, abusive or repetitive hostile content about Binance between 05:00 on 30 October and 20:00 on 2 November (UTC+8). Each account's reason for inclusion and the original posts were kept. The findings below are the author's, not PhishEye's. We have not re-run the analysis.

What the analysis found:

• Scale. 1,083 accounts posted about 11,700 hostile posts about Binance, with about 20.93 million impressions. 79.6% were replies in other people's threads rather than standalone posts. The author judged 3,354 posts false and sorted them into 15 rumour types.
• Fake compensation offers. On the evening of 1 November, a false "$150 withdrawal compensation" offer appeared in batches, telling users to check a "Rewards Hub". Of 35 such posts, 27 appeared within six hours, and five accounts posted the same wording, one of them with two followers. Binance replied under the original post that it was false and that the screenshot had been digitally altered.
• Fake official announcements. Only five posts imitated Binance itself, with forged compensation schemes or listing announcements, often carrying phishing links. Those five drew close to 300,000 impressions. The author calls this possibly the most directly harmful category for users.
• Themes followed Binance's actions. The hostile narrative changed whenever Binance did something. After the promise to cover losses came "inside job". After the impact figure came "insolvent" and "the next FTX". After the withdrawal timetable came calls to withdraw the moment withdrawals reopened. After withdrawals resumed came inflated outflow numbers with the denominator removed. The author notes that CZ put net outflow at 2.1% in the 12 hours after withdrawals resumed, while posts minutes later claimed record multi-billion-dollar outflows.
• Dormant accounts woke up. 964 accounts (89%) almost never mentioned Binance normally, yet posted about it at 24.6 times their usual rate during the incident.
• Coordination. Of the 641 most active accounts, 452 had measurable coordination ties to each other: shared comment threads, mutual replies, follows and near-identical posts. 444 of them formed one connected network that split into 11 clusters.
• A rumour about a spy. On 1 November a story spread that a Binance engineer had been seduced by a North Korean spy. Binance co-founder Yi He denied it publicly, and said ZachXBT, the on-chain investigator it was attributed to, had never said it. The story kept circulating in Chinese-language posts after the denial.

The author is careful about the limits, and so are we. Coordination between accounts is not proof that anyone paid for or directed them, and most critics were real users with real worries. Accounts with more than 50,000 followers wrote only 6.2% of the hostile posts but drew 68% of the impressions. The 134 accounts scored as most likely trolls drew only 0.6%. The author also groups some accounts into "camps" by apparent platform affinity and stresses that these are inferences, not evidence that any company was involved. We do not repeat those labels here.

Why this matters for defenders. A major incident is also a phishing event. The moment users are frightened about their money, fake compensation offers, fake reward hubs and forged official announcements start to circulate under the victim's brand. The same week Binance was fixing its wallets, it was also reporting fake posts made in its name. Incident response plans should include monitoring for brand impersonation on social platforms and lookalike domains, ready-made statements that name the official channels, and a fast takedown route.

Why the Binance hack worked: five controls that failed

Binance has not published a control-by-control post-mortem. The points below are our reading of what it has disclosed. They are not Binance's findings.

1. Software installation had no trusted path. In June, a wallet engineer got a core developer tool through an ad. That is a sign that the easiest route to the tools engineers want ran outside company channels. When the sanctioned path is slower than a search result, people take the search result.

2. Detection and cleanup did not consider what the attacker had already learned. Binance spotted the June compromise, replaced the device and rotated credentials. That handled the machine. It did not handle the knowledge the attacker had gained: who works on wallets and who their colleagues are. A compromise that exposes the people around a sensitive system should make those people a monitored group from then on.

3. A personal hiring process reached a work computer. Engineer B ran an outside company's code on the machine he used for Binance. Nothing technical stopped that. A policy against public profiles for some staff did not stop him being found. The protective control here is separation: untrusted code, including interview tests, runs only in a throwaway environment.

4. Endpoint protection missed a small, quiet change. Replacing a user-owned binary in the Homebrew directory is an easy change for an attacker and a hard one for many endpoint products to flag. The tampered pyenv ran for weeks. File-integrity monitoring of developer toolchain paths, or alerts on unusual outbound connections from developer CLI tools, might have caught it. The report does not say whether such controls existed.

5. Too much trust accumulated in too few places. One AI tool let an attacker move from one engineer's laptop to others. One deployment token on a laptop let them place code next to the signing service. And the signing service approved transfers that came from outside the normal withdrawal process. Each of these is a single point of failure. Together they meant a compromised developer laptop was a few steps away from the hot wallets.

What Binance got right deserves noting too. Its alerting fired on large transfers within minutes. It suspended withdrawals, and partners froze billions within hours. It covered customer losses within two days and published a detailed account within five. Plenty of organisations have done worse with far less at stake.

How to defend against fake job interview and developer supply-chain attacks

For developers and engineers

• Never run interview code on a work device. Treat any take-home assignment, "quick test" or repository from a recruiter as untrusted. Run it in a disposable virtual machine or cloud sandbox with no access to your credentials.
• Install tools from the official source, typed by hand. For Homebrew, that is brew.sh, reached directly, not through an ad. Better still, use your company's internal software catalogue.
• Be suspicious of escalating trust. Video calls, a CEO interview and a personal social media history are cheap to fake. A real employer will not mind you checking the company and the person through channels you find yourself.
• Report the approach. If you work somewhere attractive to attackers, tell your security team about unsolicited recruiter contact, especially contact that references your current employer.

For security teams

• Make the sanctioned install path the fastest one. Offer vetted builds of Homebrew, language version managers and AI coding tools through managed software distribution.
• Watch developer toolchain paths. Alert on changes to binaries and symlinks in /opt/homebrew, /usr/local, ~/.pyenv and similar directories that were not made by the package manager.
• Treat a contained compromise as reconnaissance. After an incident, ask what the attacker learned about people and roles, and add those people to heightened monitoring.
• Take long-lived deployment tokens off laptops. Use short-lived, workload-bound credentials issued just in time, with phishing-resistant authentication.
• Govern internal AI tools like privileged service accounts. Inventory what each tool can reach, run it with the least access it needs, require it to act as the user rather than with its own broad identity, and log its actions in a place someone reviews.

For wallet and signing infrastructure teams

• The signing service must enforce policy itself. Every signature should match an approved withdrawal from the normal pipeline. Unusual destinations, sizes, chains or transaction types, including EIP-7702 authorizations, should need extra approval from someone outside the requesting path.
• Rate-limit and size-limit hot wallets. Keep hot balances small, set velocity limits that halt signing automatically, and move funds to cold storage often.
• Plan for the drain that keeps going. Write and rehearse a procedure for revoking EIP-7702 delegations and other on-chain permissions under your signing scheme, including MPC. Know how long it takes before you need it.
• Pre-agree freezes. Fast relationships with stablecoin issuers, exchanges and analytics firms turned billions of stolen tokens into frozen tokens here. Have the contacts and the evidence format ready.

For HR, recruiting and brand teams

• Publish how you hire. A page saying which domains and platforms your recruiters use, and that you never ask candidates to run code on their own work devices, gives targets something to check against.
• Watch for your brand in fake recruitment. In this case the company was invented, but many recruitment scams impersonate real employers with lookalike domains, fake careers pages and cloned recruiter profiles.
• Plan for impersonation after an incident. Expect fake compensation offers, fake reward pages and forged announcements in your name within hours of any public incident. Watch for them, publish your official channels early, and have takedown routes ready.
• Limit what staff profiles reveal. For people with access to sensitive systems, consider guidance on listing the employer, team and role publicly.

What we still do not know

• The AI coding tool Engineer A was trying to install in June, and how the tampered Homebrew reached him.
• The name of the job platform as stated by Binance, the chat app and the fictitious company.
• The repository, the malware family, its command-and-control infrastructure and any hashes.
• What the internal AI tool is, what it could access, and exactly how it was used to reach Engineers A and C.
• How the wallet signing service was made to sign on chains other than Ethereum.
• How much of the frozen $2.85 billion will actually be returned.
• The evidence behind the FBI's attribution.

Binance says independent security firms are reviewing its findings and that it is commissioning an independent cybersecurity review. We will update this article if it publishes more.

MITRE ATT&CK mapping

This mapping is based on Binance's description. Technique choices are ours.

How PhishEye helps

This attack used a fictitious company, so watching for Binance lookalike domains would not have caught it. Many recruitment and impersonation campaigns do use a real brand, though. They copy your careers page, register a lookalike domain, clone executive and recruiter profiles, or advertise fake downloads of popular tools. PhishEye monitors for those across DNS, Certificate Transparency, web content and social platforms, and handles takedowns when it finds them. See executive impersonation protection, typosquatting protection, brand protection and phishing takedown.

Frequently asked questions

How was Binance hacked? According to Binance, attackers compromised engineers rather than Binance's external systems. A tampered Homebrew install in June exposed a wallet engineer's role and colleagues. A fake job interview in September got a second engineer to run a malicious coding assignment on his work computer. From there, using an internal AI tool and a stolen container deployment token, the attackers reached Binance's wallet signing service on 29 October and moved about $6.34 billion out of hot wallets.

How much was stolen in the Binance hack? Binance puts it at about $6.34 billion. TRM Labs estimated $6.36 billion, Chainalysis about $6.4 billion and Elliptic $6.43 billion. The differences come from pricing. It is the largest crypto theft on record, more than four times the $1.5 billion Bybit theft of February 2025.

Did Binance customers lose money? Binance says no. It set aside more than $6.34 billion of its own funds and had replaced 98% of the affected tokens by 31 October. Withdrawals were suspended for about two days and then reopened in stages.

Was the Binance hack a phishing attack? Yes, but not a phishing email. It was recruitment phishing, a form of spear-phishing that runs over a job platform and a chat app: a fake recruiter, a video interview, a chat-app interview with a fake CEO and a malicious coding test. Together with a separate tampered software install, that gave the attackers malware on engineers' machines.

Who hacked Binance? The FBI says North Korea's TraderTraitor group, part of the wider Lazarus Group umbrella, carried out the theft. TRM Labs, Chainalysis and Elliptic reached the same conclusion from on-chain evidence. North Korea denies it.

Was the Binance hack an AI hack? What was the internal AI tool? Partly. AI was not used to break in. The way in was a fake job interview and a tampered software install. But Binance says the attackers then used an internal Binance AI tool, together with a compromised laptop, to take over two more engineers' devices. Binance has not named the tool, said which model it uses or explained how it was used, and has since rebuilt it. No source says an AI model itself was hacked.

Is Binance safe after the hack? Binance says customer balances are fully backed. It replaced 98% of the stolen tokens from its own funds by 31 October, rebuilt the affected systems and revoked the stolen credentials. It is commissioning an independent security review. Withdrawals reopened in stages from 3 November.

How does the Binance hack compare with the Bybit hack? Both were attributed by the FBI to TraderTraitor, both began with a developer's machine, and neither needed a stolen private key. Bybit lost about $1.5 billion from a cold wallet in February 2025 after its signers were shown a manipulated transaction. Binance lost about $6.34 billion from hot wallets after attackers reached its signing service directly.

What is EIP-7702 and how was it used in the Binance hack? EIP-7702 is an Ethereum feature, live since May 2025, that lets an ordinary account delegate its behaviour to a smart contract. The attackers used Binance's compromised signing service to authorise a delegation from the Binance 14 hot wallet to their own sweeper contract. That let them keep moving funds after Binance suspended withdrawals, until Binance revoked it at about 00:10 UTC on 30 October. Experts say EIP-7702 made the drain easier but was not the root cause.

How can developers protect themselves from fake job interview malware? Never run a recruiter's code, repository or "assignment" on a work device. Use a disposable virtual machine with no credentials. Install developer tools only from official sources you type yourself, not from ads. Verify the company and the people independently, and report unsolicited approaches that mention your current employer to your security team.

Is the Binance hack $150 compensation offer real? No. A "$150 withdrawal compensation" offer that told users to check a "Rewards Hub" spread on X on 1 November 2026. Binance replied that it was false and that the screenshot had been digitally altered. Treat any compensation, airdrop or reward offer linked to the hack as phishing unless it appears on Binance's official website or app, and never enter your login details or 2FA codes from a link in a post or message.

What happened to the stolen crypto? About $2.85 billion has been frozen or intercepted, mostly stablecoins frozen by their issuers. The rest is being laundered across thousands of wallets and several blockchains, increasingly as BTC and ETH, which cannot be frozen by an issuer. The FBI has asked exchanges and other services to block the addresses it has published.

References

Binance

• Binance — 29 October Binance Security Incident: Initial Findings and Response Update (3 November 2026)

Government

• FBI alert on the Binance theft (31 October 2026), as reported by Yonhap in The Korea Times — FBI says N. Korea responsible for over $6 bil. crypto theft from Binance (1 November 2026)
• FBI — North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, I-090324-PSA (3 September 2024)
• FBI — North Korea Responsible for $1.5 Billion Bybit Hack, I-022625-PSA (26 February 2025)
• CISA, FBI and US Treasury — TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, AA22-108A (18 April 2022)
• Ethereum — EIP-7702: Set Code for EOAs

Reporting and analysis

• BleepingComputer — Binance says fake job interview led to $6.3 billion crypto heist (3 November 2026)

• The Block — Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach (3 November 2026)

• Fortune — North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack (3 November 2026)

• TheStreet via Yahoo Finance — Binance says its $6.3 billion hack started with a fake job offer (3 November 2026)

• Bitcoin.com News — Binance Says Fake Job Interview, Compromised AI Tools Led to $6.3 Billion Hack (3 November 2026)

• CoinDesk — North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor (3 November 2026)

• CNBC — North Korea denies links to Binance hack as researchers trace stolen billions (2 November 2026, updated 3 November)

• Associated Press via WAFB — North Korea linked to $6.3 billion hack on Binance, blockchain intelligence firms say (30 October 2026)

• Cointelegraph — How Binance's record $6.3B hack unfolded (30 October 2026, updated)

• Cointelegraph — Binance $6.3B hack raises questions over Ethereum EIP-7702 (30 October 2026)

• Ape (@immrape) on X — Engineered Panic: 78 hours, 1,083 accounts, 11,700 tweets, the second front after the Binance hack (November 2026)

• noze — Binance attack: 50 EIP-7702 signatures and a laptop (30 October 2026), summarising TRM Labs, Chainalysis and Fireblocks analyses

• BleepingComputer — Fake Homebrew Google ads target Mac users with malware (January 2025)

• PhishEye — ClickFix Drops Atomic Stealer via Fake DirBuster

• PhishEye — RubyGems Cryptojacking: Trojanized Gems