Binance, the largest cryptocurrency exchange, has disclosed details of an attack that resulted in the theft of $6.3 billion in cryptocurrency on October 29. The attackers spent several months preparing the operation, using fake versions of AI coding tools, bogus job openings, and sham interviews. They ultimately managed to compromise several engineers' work computers and gain access to systems connected to the company's cryptocurrency wallets, Business Insider reports.

The attack began with a fake AI tool

According to Binance's preliminary report, the operation began as early as June 2026. An engineer on the team responsible for cryptocurrency wallet infrastructure downloaded a modified version of an AI coding tool.

It contained malicious code that allowed the attackers to gain initial access to the employee's work environment.

Binance's security team discovered the problem, after which the company replaced the compromised device and updated the associated credentials. By then, however, the hackers may already have obtained information about the job responsibilities of the engineer and his colleagues, which helped them prepare the subsequent stages of the attack.

Fake interviews helped compromise employees' computers

In September, the attackers moved on to a more targeted attack. A Binance engineer received a message through a legitimate job-search platform. The person who contacted him claimed to be a project manager.

The employee's profile on the platform included information about his work at Binance, which likely helped the attackers select a suitable target.

What followed was a carefully prepared scheme involving two interviews. First, the engineer attended a video meeting with someone posing as a human resources employee. To build trust, that person used a social media account featuring personal photos and videos.

A second interview then took place, this time with someone claiming to be the CEO of a fictitious company. The meeting was held on a popular communications app.

During the conversation, the engineer was asked to complete a test assignment. This required him to download a code repository and run it on his work computer.

As it later emerged, the repository contained malicious code that was activated during project setup and triggered a series of unauthorized actions on the device.

In this way, a routine technical hiring assessment became a means of infiltrating corporate infrastructure.

How the hackers gained access to Binance's systems

On October 20, the attackers used the engineer's already compromised computer and the company's internal AI tool. With its help, they managed to take control of systems used by two other employees on the cryptocurrency wallet development team.

On the day of the theft itself, the attackers accessed one engineer's computer, used credentials stolen from another DevOps specialist, deployed a software container, and ran a malicious script that enabled the attack.

As a result, the attackers stole a total of $6.3 billion in cryptocurrency on October 29. According to Binance, it was the largest cryptocurrency heist in history.

The exchange's CEO, Richard Teng, said the incident was the result of a months-long campaign and described the attack as one of the most sophisticated in the history of the digital asset industry.

The trail leads to North Korean hackers

The FBI said North Korean hackers were behind the theft. North Korea, however, denies involvement in the incident.

So far, Binance has presented only preliminary findings from its internal investigation. The company intends to bring in independent cybersecurity specialists to further examine what happened.

The exchange also plans to increase investment in AI-powered threat detection systems and establish a research fund focused on blockchain security in partnership with AI companies.

The story of the hack demonstrates how dangerous attacks that combine technical vulnerabilities with social engineering can be. The hackers did not have to limit themselves to finding software flaws or directly breaching servers: they exploited employees' trust in familiar processes, including job searches and interviews.

It is particularly telling that AI tools were involved on both sides of this operation: a modified AI tool helped the attackers gain initial access, while Binance's internal tool was later used to penetrate further into the infrastructure.

For companies handling substantial digital assets, this means that protection can no longer be limited to servers, wallets, and cryptographic keys. An engineer's work computer, a repository they download, or even a job offer can become the starting point for an attack with multibillion-dollar consequences.