Binance details months-long breach using fake interviews, malware and internal AI to steal over $6 billion

How the breach was staged

Binance says the record-setting Oct. 29 heist followed a long setup. On CNBC's Squawk on the Street, co-CEO Richard Teng pushed back on the idea of a single-laptop failure and said the attackers "spent months building their way in."

He described two key moves. First, in June, he said the attackers "set up a fake version of a developer tool and lured one of our engineers to install that." A Binance security write-up adds that a Wallet DevOps engineer grabbed a tainted Homebrew installer while trying to get a popular AI coding tool from a search result. Binance flagged unusual activity at the time, swapped out the engineer's machine and changed login keys, but by then the hacker had learned the engineer's role and connections inside the wallet team.

Then in September, Teng said the same group posed as recruiters and "ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security ... from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction."

Containment, recovery and the freeze effort

Binance temporarily limited some withdrawals, promised to make customers whole and used its own funds to replenish assets impacted by the hack. The company says it has brought back 98% of the $6.34 billion affected and is still purchasing remaining, more illiquid assets.

Outside help has been material. According to reports, Binance, together with partners such as Tether, Circle and Ripple, has frozen roughly $3 billion tied to the incident, even as some of the stolen funds are still being routed through laundering networks. Coinbase shut off transfers destined for the compromised wallets and provided direct help.

Smart investors explore new tools to protect capital and sharpen decision making. We're hosting our first ever investor livestream on 11/17 to show you how to use ChatGPT and Claude to invest like a pro, hosted by Briefs Finance CEO Jaspreet Singh. Save your seat.

Binance says it is financially solid and is focused on finding the weakness, recovering what is left and preventing a repeat. The shock to crypto sentiment was sharp but brief compared with past exchange failures, and investors are tracking how quickly centralized venues can restore trust.

What changes now and why it matters

As of Tuesday, Binance says it rebuilt the affected wallet system and its internal AI tool, swapped out compromised hardware, revoked credentials and tokens tied to the impacted engineers, and widened device security scans across staff. "We're also getting an independent expert to review everything that we have done, and we'll keep strengthening our defenses as the investigation continues," Teng said. "We're working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front."

Teng did not assign blame for the hack. He noted that the FBI has tied the operation to North Korean hackers associated with the TraderTraitor group.

The bottom line: operational risk at centralized exchanges is still a live variable for crypto exposure. Watch for how quickly Binance finalizes asset restoration, third party validation and additional freezes. That pace will shape liquidity, counterparty risk and, by extension, how much exchange risk you want sitting next to your coins.

Learning how to safely use AI can give investors a thoughtful long term advantage. On 11/17, our CEO Jaspreet Singh goes live for our first ever investor livestream on how to use ChatGPT and Claude to invest like a pro. Register to join him.