Binance Says AI Tools and Fake Job Interviews Fueled $6.3 Billion Hack

Hackers stole more than $6 billion in assets from Binance, the world's largest crypto exchange, after a months-long infiltration that began with a fake developer tool, moved through fraudulent job interviews, and ended in compromised internal AI tools, the company said Tuesday.

Binance co-CEO Richard Teng laid out the attack sequence in an interview with CNBC's "Squawk on the Street." He rejected the notion that the Oct. 29 cyberattack — the largest in crypto history — traced back to a single point of failure on one employee's laptop.

The attackers "spent months building their way in," Teng told CNBC.

How did the attackers get inside Binance?

According to Teng, the operation unfolded in three stages across the summer and fall.

In June, the attackers set up a counterfeit version of a developer tool and persuaded a Binance engineer to install it. In September, they switched tactics.

"In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security," Teng said. "From there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction."

A security report Binance published Tuesday fills in the mechanics of the June stage. A Binance Wallet DevOps engineer downloaded a tampered Homebrew installation — Homebrew is a widely used package manager for installing software on macOS — "to install a popular AI coding tool after searching for it on a search engine," the report said.

Binance said it detected the suspicious activity, replaced the engineer's device and rotated credentials as a precaution. But the response came too late to contain the exposure. By that point, the employee's "role and his related colleagues on our wallet infrastructure team was exposed to the hacker," the report stated.

The June intrusion gave the attackers a map. The September social-engineering operation gave them the keys.

Who is behind the attack?

Teng stopped short of attributing the attack to any state actor. He acknowledged, however, that the FBI has linked it to North Korean hackers tied to the TraderTraitor group — a designation that aligns the Binance breach with a long pattern of North Korean cryptocurrency theft documented by U.S. authorities.

The FBI's attribution stands on its own; Binance itself has not independently confirmed it. That gap matters for an investigation that is still running.

How much of the $6.34 billion has been recovered?

Teng said Binance has replenished 98% of the $6.34 billion in affected assets. The company is still working to purchase the outstanding, more illiquid assets.

Binance and industry partners including Tether, Circle and Ripple have frozen about $3 billion in assets, according to reports — but some stolen funds continue to move through laundered channels. Coinbase blocked transfers to compromised wallets and offered Binance direct assistance.

The company has also taken a set of concrete remediation steps:

• Rebuilt the affected wallet system and internal AI tool
• Replaced compromised devices
• Decommissioned credentials and tokens associated with the affected engineers
• Expanded security scans across employee devices
• Temporarily restricted certain withdrawals
• Tapped its own reserves to replenish affected assets
• Pledged to cover all customer losses

Teng detailed the remediation timeline on "Squawk on the Street" as of Tuesday. The withdrawal restrictions and reserve draws signal that the recovery, despite the 98% figure, is not yet complete on Binance's own balance sheet.

"We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said. "We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds."

An independent review is the right safeguard — but until its findings are public, the company's own account of the breach is the only detailed narrative available.

Why does this hack matter beyond Binance?

The stakes run past one exchange. The attack represents the largest crypto theft on record, and the technique — poisoning an AI coding tool's installation path — targets a workflow now standard at engineering organizations across the industry. Supply-chain compromise of developer tooling (malicious code inserted into trusted software distribution channels) is not new, but pairing it with recruiter impersonation and lateral movement into internal AI systems marks a more patient and layered playbook.

The hack dealt a sharp but short-lived blow to confidence across crypto markets, particularly when measured against previous failures at major exchanges. Binance maintains that it remains financially sound and focused on identifying the vulnerability, recovering remaining funds and preventing another attack.

Investors are now watching whether Binance can fully restore confidence in centralized exchanges — platforms that hold customer assets in custody, as opposed to decentralized exchanges where users control their own keys. A breach of this scale at the industry's largest player tests the custodial model itself, not just one company's defenses.

The 98% replenishment figure is the strongest evidence Binance can offer right now. The remaining 2% — roughly $127 million in illiquid assets — and the still-moving laundered funds will define whether that confidence holds.

What comes next?

Teng said the investigation continues, with law enforcement agencies and industry partners working to trace and freeze what remains of the stolen funds. The independent expert review of Binance's remediation will test the company's claim that its rebuilt systems can withstand a repeat of the same multi-month, multi-vector attack.

Until those findings land and the frozen $3 billion translates into returned assets, the full cost of the Oct. 29 breach remains an open ledger.