Binance details fake recruitment tactics behind $6.34 billion attack

Key points

Binance disclosed that hackers used fake recruitment interviews and malicious software to compromise employee computers before its 29 October security incident.
The attack affected approximately $6.34 billion in digital assets, with $2.85 billion frozen or intercepted.
Investigators identified compromised credentials, internal AI tools and wallet-signing access as key parts of the attack.

Binance has revealed how hackers used fake recruitment interviews to compromise employee computers before its $6.34 billion security incident.

The attackers exploited compromised credentials and internal systems to access wallet-signing infrastructure on 29 October 2026.

“This should not have happened,” Binance said in its initial security incident report.

The attackers distributed malicious software through a fake job assignment, gaining access to an employee's work computer.

They later exploited an internal AI tool to reach other employees and obtain access to deployment credentials.

The breach enabled unauthorised transfers across several networks, including 233.46 million XRP, 970,500 SOL and 18,270 BTC.

Binance froze or intercepted approximately $2.85 billion in assets and replenished 98% of affected token holdings by 31 October.

The exchange is commissioning an independent cybersecurity review and expanding AI-based detection to strengthen its wallet security systems.