Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach
The Block reports Binance's initial incident report, published 3 November 2026, on a theft of more than $6.3 billion. Binance says a fake job interview compromised an employee and an internal AI tool exposed wallet-signing systems. Binance says it froze or intercepted about $2.85 billion and replenished 98% of impacted assets. Withdrawals reopened in phases from 4 a.m. UTC across BSC, Ethereum, Solana and other networks. The FBI links the attack to North Korea, which denies it. The available text gives no deeper technical detail.
TL;DR Binance's incident report ties a $6.3 billion theft to a fake job interview and an internal AI tool, with $2.85 billion frozen.
Organisations named here
- FBI
- Binance
- The Block
Technologies named here
- Binance
- Ethereum
- Solana
- BNB Smart Chain
- Binance internal AI tool
- Binance wallet-signing systems
- BSC
Techniques named here
- Fake job interview social engineering
Concepts named here
- Internal AI tool exposure of wallet-signing systems
Threat actors named here
- North Korea
- DPRK
Related in Blockchain

THORChain Exploit Report #2 — GG20 root-cause disclosure

Black Thursday revisited: MakerDAO keeper exploited for $500K
.jpg)