# Binance says attackers used an internal AI tool on the way to a $6.34bn hot-wallet theft

Source: https://www.bankingnewsai.com/ai-incidents/binance-2026-internal-ai-tool-hot-wallet-theft
Last updated: Nov 10, 2026

Binance · Institution's own AI · severity 5 of 5

On 29 October 2026 attackers drained about $6.34 billion in crypto assets from Binance's hot wallets, the largest crypto theft on record. In initial findings published on 3 November 2026, Binance said the campaign began in June, when a wallet DevOps engineer downloaded a tampered installer while looking for a popular AI coding tool, continued in September with fake job interviews that put malware on a second engineer's work computer, and on 20 October used that computer and an internal AI tool to take control of two wallet engineers' systems. Binance has not explained how the AI tool was used; it said it rebuilt the tool and its access controls. The FBI attributed the theft to North Korea's TraderTraitor group. Binance said it would absorb the loss and that about $2.85 billion had been frozen or intercepted.

## Key facts

|  |  |
| --- | --- |
| Date | Oct 29, 2026 |
| Institution | Binance |
| Country | Several countries |
| AI system | An internal AI tool at Binance (not named or described further in the company's report), which the company says the attacker used to take control of two wallet engineers' systems |
| AI? | Described as AI by the institution or regulator — The institution, a regulator or a court called the system AI. |
| Category | Other (Institution's own AI) |
| Status | Confirmed by the institution |
| Severity | 5 of 5 — About $6.34 billion in crypto assets taken from the exchange's hot wallets, withdrawals suspended for all customers for days, and a theft the FBI attributes to North Korea's TraderTraitor group; Binance says it is absorbing the loss. |

## What happened?

Binance said that at around 20:05 UTC on 29 October 2026 its hot wallets were compromised, with a loss of approximately $6.3 billion in token assets; it suspended withdrawals while it contained the breach. Its later report put the affected assets at about $6.34 billion. On 31 October the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October, activity it tracks as TraderTraitor. North Korea denied involvement. [1][2][4][5]

In initial findings published on 3 November, Binance described a multi-stage campaign rather than a single breach. In June a Wallet DevOps engineer downloaded a tampered Homebrew installation while searching for a popular AI coding tool; the security team detected it, replaced the device and rotated credentials, but the engineer's role and his colleagues on the wallet infrastructure team were exposed to the attacker. In September a second engineer, approached through a legitimate job-hunting platform, went through two fake interviews and was told to download an 'assignment' that installed malware on his work computer, which Binance said its endpoint security tools did not detect. [3][6][7][8]

On 20 October, according to Binance's report as quoted by the Guardian, SecurityWeek and the BBC, the attacker used the second engineer's compromised computer and an internal AI tool to gain control of the first engineer's system and that of another wallet engineer. The first engineer's computer held a token that allowed container deployments. On 29 October the attacker logged on to the third engineer's computer, used credentials stolen from the first, deployed a container and triggered a malicious script, then exploited unauthorized access to an internal wallet signing service to move assets out of the hot wallets. [4][5][6][8]

The role of the AI tool is the least documented step. SecurityWeek noted that the report does not explain how the tool was used, and The Verge wrote that there is little detail on the tool or on why it was able to help the attackers. Co-chief executive Richard Teng told CNBC the attackers moved through 'our internal AI tools' to reach the system that authorizes wallet transactions. Separately, security experts cited by Bloomberg suggested the hackers may themselves have used AI to plan the attack; The Next Web, reporting on that article, said this had not been confirmed. [3][7][8][9]

## Timeline

- Jun 2026 — A Binance Wallet DevOps engineer downloads a tampered Homebrew installation while looking for a popular AI coding tool; Binance detects it and replaces the device, but the wallet team's roles are exposed, the company later says. [3][8]
- Sep 2026 — A second engineer is recruited through fake job interviews and installs a malicious 'assignment' on his work computer. [5][8]
- Oct 20, 2026 — The attacker uses the compromised computer and an internal AI tool to gain control of two wallet engineers' systems, per Binance's report. [5][8]
- Oct 29, 2026 — About $6.34 billion in crypto assets is moved out of Binance's hot wallets through an internal wallet signing service; withdrawals are suspended. [1][8]
- Oct 31, 2026 — The FBI attributes the theft to North Korea's TraderTraitor actors. [2]
- Nov 1, 2026 — Binance begins reopening withdrawals in phases. [4][8]
- Nov 3, 2026 — Binance publishes its initial findings, naming the compromise of an internal AI tool among the techniques used, and says it has rebuilt the tool. [3][4][8]

## What was the impact?

- Financial: About $6.34 billion in crypto assets taken; about $2.85 billion frozen or intercepted as of 3 November 2026, per Binance
- Customers: Withdrawals were suspended for customers globally from 29 October and reopened in phases from 1 November; Binance said users would not bear the loss and that 98% of the affected token assets had been replenished. [1][4][5][8]

## How did Binance respond?

Binance called it a 'serious and highly sophisticated security incident', apologised and said 'this should not have happened'. It said it would absorb the financial impact through its Secure Asset Fund for Users and corporate treasury, and that it had rebuilt the affected wallet system and the internal AI tool, replaced compromised devices, decommissioned the affected engineers' credentials and tokens and expanded security scans across employee devices. It said it was commissioning an independent cybersecurity review, expanding investment in AI security and setting up a security research fund. [1][3][4][6][8]

## What was the outcome?

Ongoing as of 10 November 2026. Binance describes its report as initial findings subject to independent review. About $2.85 billion of the stolen assets had been frozen or intercepted by 3 November, withdrawals had broadly resumed, and Binance said 98% of the affected tokens had been replenished from its own funds. The FBI published addresses linked to the theft and asked virtual-asset firms to block them. [2][5][7][8]

## FAQ

### What role did AI play in the 2026 Binance hack?

Binance's initial findings, published on 3 November 2026, list the compromise of internal AI tools among the attackers' techniques: on 20 October the attacker used an engineer's infected computer and an internal AI tool to take control of two wallet engineers' systems. Binance has not said what the tool was or how it was used. The first foothold, in June, was a tampered installer an engineer downloaded while looking for a popular AI coding tool.

### Did the Binance hackers use AI themselves?

That has not been confirmed. Security experts cited by Bloomberg suggested North Korean hackers may be using AI to plan thefts, and The Next Web reported that this was presented as an assessment, not an established fact. What Binance has confirmed is that its own internal AI tool was used in the attack path.

### How much was stolen from Binance and did customers lose money?

About $6.34 billion in crypto assets was taken from Binance's hot wallets on 29 October 2026. Binance said it would absorb the loss, that about $2.85 billion had been frozen or intercepted by 3 November, and that 98% of the affected tokens had been replenished from its own funds.

## Sources

1. [Security Incident Update #2 (2026-10-30)](https://www.binance.com/en-GB/support/announcement/security-incident-update-2-2026-10-30-d3306d9dca5243548c813b605e1d1751) — Binance, Oct 30, 2026 (official): "At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets."
2. [North Korea Responsible for $6 Billion+ Binance Attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) — Federal Bureau of Investigation, Oct 31, 2026 (official): "The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor.""
3. [Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html) — CNBC, Nov 3, 2026 (news): "Binance said hackers used fake job interviews, malicious software and compromised internal AI tools to infiltrate its wallet infrastructure"
4. [Binance says fake job interviews used as part of $6.3bn crypto hack](https://www.bbc.com/news/articles/ck5ynwz9gy67o) — BBC News, Nov 3, 2026 (news): "Hackers who stole a record $6.3bn (£4.7bn) from Binance used fake job interviews and a compromised internal AI tool, the firm has revealed."
5. [Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’](https://www.theguardian.com/business/2026/nov/03/hackers-63bn-binance-heist-malware-bogus-job-interviews-cryptocurrency) — The Guardian, Nov 3, 2026 (news): "Binance said $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted."
6. [Binance says hackers used fake job interviews and AI tools in $6.3bn hack](https://www.finextra.com/newsarticle/48694/binance-says-hackers-used-fake-job-interviews-and-ai-tools-in-63bn-hack) — Finextra, Nov 3, 2026 (news): "The following month, the attacker used the compromised computer to access an internal AI tool to gain control over the Wallet DevOps engineer's system and that of one of their team members."
7. [Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist](https://www.theverge.com/news/1025576/binance-cyrpto-theft-explained) — The Verge, Nov 3, 2026 (news)
8. [Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist](https://www.securityweek.com/rigged-coding-assignment-abused-ai-tool-opened-path-to-6-billion-binance-heist/) — SecurityWeek, Nov 4, 2026 (security research): "The report does not explain how the AI tool was used."
9. [North Korean hackers used AI in crypto heists record $6bn Binance theft](https://thenextweb.com/news/north-korean-hackers-ai-crypto-heists-binance) — The Next Web, Nov 2, 2026 (news): "The use of AI has not been confirmed, and Bloomberg presents it as the experts’ assessment rather than an established fact."

## Related incidents

- [Binance says scammers used an AI deepfake of its communications chief in listing-scam calls](https://www.bankingnewsai.com/ai-incidents/binance-2022-executive-deepfake-zoom-calls)
- [AI-agent-assisted intrusions breach Shinhan, KB Kookmin, Hana and 13 other Korean financial firms](https://www.bankingnewsai.com/ai-incidents/korean-banks-2026-artex-ai-agent-intrusions)

All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents

---

Canonical page: https://www.bankingnewsai.com/ai-incidents/binance-2026-internal-ai-tool-hot-wallet-theft
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.