Binance Details Fake Job Interview, AI Tool Role in $6.3 Billion Cyberattack
The cryptocurrency exchange said attackers used social engineering, compromised software and an internal AI tool to access its wallet systems.
- By Alex Saurman
- Nov 03, 2026
Binance has released new findings about the cyberattack that affected approximately $6.34 billion in digital assets, detailing how attackers used a fraudulent job interview, compromised software and an internal artificial intelligence tool to gain access to company systems.
According to the company's Nov. 3 report, the intrusion involved multiple stages beginning in June, when an employee on its wallet development operations team unknowingly downloaded a tampered Homebrew installation while attempting to install an AI coding tool.
Binance detected the suspicious activity, replaced the affected device and rotated related credentials, although the employee’s role and other colleagues on the team had been exposed to the attacker, the company said.
In September, another engineer was contacted through a job-search platform about a position at a company that did not exist. In the second of two interviews, the employee was instructed to download a coding assignment onto a work computer. The assignment contained malware that went undetected by the company's endpoint security tools at the time, Binance said.
The attackers subsequently exploited the compromised computer and an internal AI tool to gain control of two other employees' systems on Oct. 20. Nine days later, they used stolen credentials and another employee's computer to deploy malicious code that enabled the theft.
Binance said the attackers gained unauthorized access to its wallet signing service, allowing transactions outside the company's normal withdrawal procedures. The attackers also exploited Ethereum's EIP-7702 authorization mechanism to continue transferring assets after withdrawals were suspended.
As part of its response, Binance has rebuilt affected systems, replaced compromised devices and strengthened wallet-service risk controls, among other measures. The company also announced plans for an independent cybersecurity review and additional investment in AI-based detection, endpoint protection and developer security.
About the Author
Alex Saurman is the Managing Editor of Security Today and Campus Security Today.