Fake job interviews and an exploited internal AI tool preceded Binance’s $6.34 billion hack on October 29, 2026, the exchange’s initial report shows. Attackers reached a wallet signing service, and suspending withdrawals alone was not enough to stop their malicious on-chain authorizations.
The compromise began in September, when attackers used bogus job interviews to plant malware on an engineer’s device . They later exploited an internal AI tool to reach wallet engineers, then used stolen credentials to compromise the service responsible for signing wallet transactions.
Binance said the attackers abused Ethereum’s EIP-7702 authorization mechanism . The malicious authorizations required a separate revocation process to block unauthorized transactions: halting withdrawals did not, by itself, disable them.
Asset containment after Binance’s $6.34 billion hack
Approximately $2.85 billion in affected assets has been frozen or intercepted, Binance said. The exchange also reported that 98% of affected token assets had been replenished by October 31, with sufficient funds reserved to cover all losses.
Binance said it used its corporate treasury, futures insurance and emergency reserve funds to replace customer assets. The breach affected its global centralized exchange, Binance.com; its US-facing platform said it was not affected.
Withdrawals resumed for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum . Data shared by Richard Teng showed customers withdrew $10.97 billion over 46 hours, exceeding deposits by $5.28 billion. Teng said hourly deposits were beginning to exceed withdrawals.
The FBI attributed the attack to North Korea and published wallet addresses linked to TraderTraitor, also known as the Lazarus Group, urging industry partners to block transactions involving them.
The investigation into Binance’s $6.34 billion hack remains ongoing.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
