Signal
Binance says fake interviews and a compromised AI tool led to $6.34 billion hack
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-11-03 14:32 UTCUpdated 2026-11-04 04:47 UTC
rsstelegram
crypto_securityexchangehackscybersecurityainorth_korea
Trend in the last 24h
Current brief openSource links open
This current signal is open on the public brief with summary, metadata, source links, and full evidence. Pro adds compare-over-time, alerts, exports, and workflow.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
Binance says the $6.34 billion theft followed a months-long campaign involving fake job interviews, a malicious software download, compromised employee systems, malware, and an internal AI tool. The attackers ultimately reached hot-wallet signing infrastructure. Binance says it froze or intercepted about $2.85 billion and replenished 98% of affected tokens, while reporting and commentary focus on alleged North Korea links, AI-enabled threats, and wider crypto-sector security implications.
Entities
BinanceCoinExRichard TengJimmy SuChangpeng ZhaoYi HeHaipo Yang
Why now
- Binance released its first detailed public account of the attack.
- Coverage is examining suspected North Korea-linked cyber activity.
- Industry figures are warning about AI-enabled attacks.
Why it matters
- The reported path from recruitment scams to wallet-signing infrastructure highlights risks across personnel, software, and custody controls.
- Binance’s reported recovery and replenishment efforts underscore the operational stakes of exchange incident response.
- The incident has intensified discussion of AI-enabled threats to crypto firms.
Evidence assessment
Recurring claims
- Binance says the theft began with fake job interviews and escalated through malware, compromised systems, and an internal AI tool.
- The attackers reached Binance’s hot-wallet signing infrastructure, with reporting linking the operation to North Korea.
- Binance says it froze or intercepted about $2.85 billion and replenished 98% of affected tokens.
How sources frame it
- Binance: neutral
- Changpeng Zhao: questioning
- Haipo Yang: questioning
Binance’s account shifts the incident from a single breach to a months-long social-engineering and wallet-security storyline.
All evidence
All evidence
North Korea-linked attack methods
decrypt.co · decrypt.co · 2026-11-03 17:30 UTC
What happens if North Korea steals Wall Street's tokenized assets next
CoinDesk · coindesk.com · 2026-11-03 23:00 UTC
Binance says hack began with fake job interview
bitcoinmagazine.com · bitcoinmagazine.com · 2026-11-03 16:44 UTC
Binance’s $6.3B hack could have been prevented, CoinEx founder claims
Crypto · crypto.news · 2026-11-04 04:47 UTC
Kim Jong-un, crypto bros and a $6.3bn heist – podcast
Theguardian (via guardian_cryptocurrencies) · theguardian.com · 2026-11-04 03:00 UTC
Show filters & breakdown
Evidence items loaded: 0Publishers: 5Origin domains: 5Duplicates: -
Showing 5 / 16