Skip to content
NewA calmer, faster ZeroHour
StoryData breachcriticalExploited in the wild

Fake interviews and AI tools enabled $6.34B Binance theft

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

The FBI links a roughly $6.34 billion Binance hot-wallet theft to North Korea; recovery figures still conflict and the investigation continues.

Binance says attackers stole about $6.34 billion from hot wallets on October 29, 2026, in a campaign that began no later than June. Fake job interviews and coding tasks led engineers to run tampered software, after which malware reached an internal AI tool and wallet-signing systems. The FBI attributes the operation to North Korea; outlets name Lazarus, also called APT38, or the TraderTraitor cluster. Binance froze or intercepted about $2.85 billion, rebuilt systems, and is cooperating with investigators, but Help Net Security reports about $3 billion returned, SecurityWeek says $3.18 billion remains in linked addresses, and Risky Business News says $2.8 billion in stablecoins was recovered with $3.25 billion unrecoverable. The investigation remains ongoing.

Key facts
  • October 29 theft hit Binance hot wallets holding XRP, SOL, OP, and BTC.
  • Social engineering began by June; September fake interviews and a tampered Homebrew installer were used.
  • Malware and an internal AI tool reached wallet signing and additional engineer systems.
  • FBI attributes the hack to North Korea’s Lazarus group or TraderTraitor cluster.
  • Binance intercepted about $2.85 billion; outlets disagree on funds returned or still missing.
  • Affected credentials were decommissioned and systems rebuilt; the probe continues.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Attackers stole crypto from Binance hot wallets. · GBHackers
  2. Oct 30, 2026Binance cleared wallet delegation at 00:10 UTC. · GBHackers
  3. Oct 31, 2026Binance replenished 98% of affected token assets. · GBHackers

What each outlet adds

beyond the shared facts
  • Infosecurity MagazineLists stolen XRP, SOL, and OP amounts and 57 suspected attacks.
  • The RegisterMalware replaced a pyenv component; credentials and tokens were decommissioned.
  • Ars TechnicaCites 18,270 BTC moved, EIP-7702 abuse, MPC wallets, and Proof of Reserves.
  • Risky Business NewsSays 11 cryptocurrencies were taken and $3.25 billion is unrecoverable.
  • SecurityWeekPuts $3.18 billion still in theft-linked addresses.
Vendors
Binancebinance
Products
cryptocurrencieshot walletsSolanaOptimismEthereumcrypto exchange
Threat actors
TraderTraitorLazarus GroupNorth Korean hackersNorth Korean actorsNorth Korea
Malware
zero-day malware
Victims
Binance
Organizations
FBICoinDeskTRM Security
Countries
North Korea

Coverage

oldest first · one row per article · UTC
  1. · 8d ago Security AffairsFirst report

    Binance hack exposes $6.34 billion theft

    Binance attributes $6.34 billion theft to North Korea-linked Lazarus Group using fake job interviews and AI abuse.

  2. · 8d ago TechCrunch · Security

    North Korean hackers steal $6.3B from Binance

    Hackers used fake recruiter contacts to trick an engineer into downloading malware, stealing $6.3 billion in crypto.