Crypto exchange Binance has revealed details of a large-scale hacking attack on October 29, 2026, in which digital assets worth approximately USD 6.34 billion were affected. According to the company’s preliminary report, published on November 3, the perpetrators had been preparing the operation for months, infiltrating employees’ computers and using an internal artificial intelligence tool to reach the infrastructure managing crypto wallets.
The investigation shows that the preparations began as early as June, when a Binance employee downloaded a tampered installation file for the Homebrew software while attempting to install an artificial intelligence programming tool. Security systems detected the suspicious activity, but the attackers had already obtained information about the employees responsible for crypto wallets.
In September, another developer was lured into a fake job interview. The hackers, posing as employers, convinced him to download a test project containing malicious code. This gave them access to his work computer without the security software detecting the intrusion.
On October 20, the attackers used the compromised computer and an internal AI tool to reach the devices of two more engineers. They subsequently obtained the necessary permissions to deploy malicious software within the exchange’s infrastructure.
The attack itself was carried out on October 29, when the hackers gained unauthorised access to an internal cryptocurrency transaction-signing service. In just four minutes, 233.46 million XRP was transferred from five of Binance’s online wallets. Approximately 970,500 SOL, 44.2 million OP and 18,270 bitcoins were also drained.
The attackers also used a specific mechanism of the Ethereum network that allowed them to retain the ability to transfer funds even after the exchange temporarily halted withdrawals. The last unauthorised transaction was confirmed on the blockchain shortly before midnight.
FBI blames North Korea
The US Federal Bureau of Investigation said on October 31 that hackers linked to North Korea were behind the theft. According to the FBI, the operation was part of the cyber activity known as TraderTraitor, in which perpetrators use social engineering and sophisticated technical methods to steal digital assets.
Binance said that approximately USD 2.85 billion of the affected assets had been frozen or intercepted, with the final figure still subject to clarification. As of October 31, the company had recovered 98% of the affected token assets and continues to recover the remainder.
The exchange assured users that it would bear the financial consequences of the incident and had set aside sufficient funds to cover the losses. Following the attack, the compromised devices were replaced, wallet management systems were updated and cybersecurity measures were strengthened.
The company also plans to establish a research fund for artificial intelligence security in blockchain environments.
The case shows how a combination of human error, fake job offers and compromised AI tools can threaten even technology companies with large-scale information security infrastructure. The investigation is ongoing, and the conclusions published by Binance remain preliminary.
