Binance Says Fake Job Interview and Internal AI Tool Led to Record $6.3 Billion Crypto Hack

Binance says hackers used a fake job interview to compromise an employee’s computer and then exploited an internal artificial intelligence tool to carry out unauthorized transactions, the exchange’s most detailed account yet of the $6.3 billion theft, the largest in cryptocurrency history.

The world’s largest crypto exchange said it has replenished about 90 percent of the stolen assets, covering roughly $6 billion of the estimated losses, according to Fox Business. Co-CEO Richard Teng told the outlet that customers will not bear any losses, and the exchange has said about $3 billion of the stolen funds was frozen as investigators worked to trace them.

The attack took place on Thursday, October 29. According to CoinDesk, attackers drained an estimated $6.3 billion from Binance’s hot wallets across multiple blockchains late that day. Blockchain analytics firm TRM said the attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. Binance said on Friday that the incident had affected about $6.3 billion in client assets, and it suspended deposits and withdrawals while it investigated. Founder Changpeng Zhao said on X that it did appear to be a hack.

The explanation of how the breach happened has changed as the investigation has progressed. In its first statement, Binance said the hack might involve a compromised DevOps engineer’s laptop that allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. Teng later said the attack involved a more complex process and not the misuse of a single engineer’s permissions, according to CNBC. The latest account describes a multistage attack that began with a fake job interview, which compromised an employee’s computer, and ended with the exploitation of an internal AI tool to carry out the unauthorized transactions. Binance has said it will publish a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

The response from the rest of the crypto industry was fast. Stablecoin issuers Tether and Circle froze funds tied to the hack, and Ripple froze roughly $200 million in potentially affected funds, according to Reuters. Binance worked with those partners to freeze about $3 billion, which means roughly half of the stolen value was immobilized within days. Binance has said that this frozen money is separate from its own reserves.

Also Read: Binance Confirms Hack With Estimated $6.3 Billion Impact, Suspends Withdrawals as Bitcoin Falls Below $78,000

To reassure customers, Binance said it set aside more than $6.34 billion of company funds to restore customer balances, with $5 billion already held in the exact token assets that were affected, CoinDesk reported. In practice, the exchange is using its own money to buy matching cryptocurrencies so that balances can be restored one-for-one without touching other customers’ funds. Binance co-founder Yi He said earlier that withdrawals were expected to resume within days, and the exchange has described the suspension of deposits and withdrawals as temporary.

The market reacted to the news. Bitcoin fell more than 4 percent to about $77,995 on Friday as the hack weighed on crypto markets, according to CNBC. Bloomberg described the incident as the latest in a series of security breaches afflicting the financial sector, and it has renewed questions about how well even the largest platforms can protect assets held in hot wallets, which are connected to the internet so that they can process withdrawals quickly.

The scale makes it the biggest crypto theft on record by dollar value. It is more than four times the roughly $1.5 billion stolen from the exchange Bybit in February 2025, which the FBI attributed to North Korean hackers it calls “TraderTraitor.” Blockchain analysis company Chainalysis has said it believes the Binance attack was also likely carried out by TraderTraitor, according to a post by its co-founder and CEO, Jonathan Levin. That is a private-sector assessment, and the reports reviewed do not show a formal attribution by law enforcement. Binance has also not publicly named a culprit in the reports reviewed.

The use of a fake job interview as the entry point is notable because it targets people instead of software. Recruitment-style approaches rely on persuading an employee to open a file or run code during what looks like a normal hiring process, which can bypass technical defenses. The reports reviewed do not say which employee was targeted, what role they held, or how the AI tool came to be exploitable, and those are likely to be among the main questions the post-mortem will have to answer.

For Binance, the immediate priority is restoring trust. The company has pledged to make customers whole, replaced about nine-tenths of the stolen assets from its own resources, and promised a full account of what happened. For the wider industry, the case is a reminder that the largest security risks can come from an employee’s computer and internal tools, not just from flaws in blockchain code, and that the speed of the response, including the freezes by Tether, Circle and Ripple, may decide how much of a record theft is ultimately lost for good.