Binance Ties $6.3B Hack to Fake Job Interview, Says 98% Replenished

Update: November 3, 15:41 UTC

Attackers used a compromised computer and an internal AI tool to reach wallet engineers and take control of wallets, according to Binance's incident report, as cited by Crypto Briefing and The Defiant. The Defiant said persistent onchain permissions complicated containment.

Blockonomi reported that the attackers spent months targeting Binance employees and installing malware before the Oct. 29 theft, with the fake job interview serving as the entry point for the malware. The Block said the internal AI tool gave the hackers access to systems involved in the theft.

Crypto Briefing said the breach exposes weaknesses in AI tools and internal systems, and urged exchanges to look beyond private key protection.

Original report: November 3, 14:51 UTC

Binance says 98% of tokens hit in its $6.3 billion hack have been replenished. It also says how the attackers got in: a fake job interview, part of a months-long social engineering campaign.

The exchange's report lays out that campaign and explains why pausing withdrawals did not stop every outflow. Our earlier coverage tracked the Oct. 29 theft and the first reopening of withdrawals, when backing stood at 95%.

Withdrawals and reserves

Phase two started at 04:00 UTC on Tuesday, Nov. 3. It covers networks including Ethereum, Solana, XRP Ledger, Tron and Base, following the initial reopening on Nov. 1.

Net outflows fell to $2.57 billion on Monday.

Binance also published a zero-knowledge reserve proof for BTC, ETH and 8 other tokens. A new snapshot covering more tokens is set for Nov. 4. The exchange says the last 5% of affected funds sits in less liquid assets.

The recovery has knock-on effects. Binance missed its monthly Luna Classic burn for the first time since 2023. Insurance may not fill the gap either: one report says Binance may recover little of the losses that way.

Attribution

The FBI pins the theft on TraderTraitor, a North Korean hacking operation, and has urged exchanges and blockchain services to block transactions involving identified addresses. Kim Yo Jong rejected the claim in a statement published by KCNA.

"As regards this extra-large incident, the U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea again"

Kim Yo Jong

Elliptic rejected the denial, saying its investigation supports the FBI attribution. The firm traced the stolen funds through thousands of wallets and found evidence of automated laundering, but no proof that AI agents directed the transactions.

Loss estimates run from $6.3 billion to $6.4 billion. Next checkpoint: the Nov. 4 snapshot.