Binance’s $6.34B hack began with fake interviews and an AI tool exploit

What it is

Binance's initial report on the 29 October 2026 compromise of Binance.com, its global centralized exchange, which lost $6.34 billion. The FBI attributes the attack to North Korea's TraderTraitor group, also known as Lazarus Group. The investigation is ongoing. The page is a news article that was produced with AI assistance and reviewed by editors, and it relays Binance's report rather than the report itself.

How it works

The page gives the chain only in outline. Attackers used fake job interviews in September 2026 to plant malware on an engineer's device. They then exploited an internal AI tool to reach wallet engineers and used stolen credentials to compromise the wallet transaction signing service. They abused Ethereum's EIP-7702 authorization mechanism. The page does not explain how the AI tool was exploited or how the malware was delivered.

What to do

• Revoke EIP-7702 authorizations separately. Binance said the malicious authorizations stayed valid after withdrawals were suspended. Revoking them was a distinct step that had to be done to block unauthorized transactions. An incident runbook that treats a withdrawal halt as full containment would miss this.
• Block the FBI-published addresses. The FBI released wallet addresses linked to TraderTraitor and asked industry partners to block transactions involving them. The page does not list the addresses, so take them from the FBI's own publication.

Impact and recovery figures (from Binance)

• About $2.85 billion of affected assets was frozen or intercepted.
• By 31 October, 98% of affected token assets had been replenished. Binance said it reserved enough funds to cover all losses.
• Replacement funds came from the corporate treasury, futures insurance and an emergency reserve.
• The US-facing platform said it was not affected.
• Withdrawals resumed for more than two dozen major cryptocurrencies, including Bitcoin and Ethereum.
• Richard Teng shared data showing customers withdrew $10.97 billion over 46 hours, $5.28 billion more than deposits. Teng said hourly deposits were starting to exceed withdrawals.

Caveats

This is an initial report. The root-cause details, the scope of the AI tool's access and the full address list are not in the article.