Binance details job-interview and AI-tool links in $6.34 billion cyber incident

Binance said approximately $6.34 billion in digital assets were affected by the security incident on October 29, 2026. The FBI separately said more than $6 billion in virtual assets were stolen from Binance on or about that date.

The exchange identified several elements in the attack, including deceptive recruitment interviews, harmful downloads, compromised endpoints and misuse of an internal artificial-intelligence tool. Binance said an engineer downloaded malicious code during a job-interview process in September.

Binance also said the internal AI system was used on October 20 to reach two additional employee computers. The company has not described that tool as the only pathway into its systems; its account lists multiple attack techniques.

The FBI classified the activity as TraderTraitor, a cyber operation linked to North Korea. The bureau said the stolen assets were mainly changed into Ether during attempts to launder them. Binance attributed the attack to a months-long operation linked to North Korea, according to Axios.

The incident’s reported value differs depending on how the losses are described. Binance’s figure covers approximately $6.34 billion in affected digital assets, while the FBI referred to more than $6 billion in stolen virtual assets. Axios described the amount as approximately $6.3 billion in stolen cryptocurrency.

Binance said it had restored 98% of the affected token assets by October 31. The company also said approximately $2.85 billion in assets had been frozen or intercepted as of November 3.

Those figures describe separate stages of the response. The replenishment figure concerns affected token assets, while the frozen-or-intercepted figure concerns assets stopped or recovered through intervention. The available accounts do not establish that the two amounts should be added together.

Richard Teng is a Binance co-CEO alongside co-founder Yi He. Teng has been identified in reporting about the incident as a company executive discussing the attack and its recovery.

The verified accounts provide a partial picture of the intrusion. They identify the recruitment process, the malicious download, the endpoint compromises and the internal AI tool, but they do not provide a complete technical sequence for every step. They also do not establish how much of the stolen cryptocurrency ultimately remained unrecovered.

The FBI’s attribution gives the incident a wider cybersecurity significance because it connects the Binance theft to a North Korea-linked operation that has also been identified by name. The agency’s description of Ether conversions explains one part of the laundering activity, but the supplied facts do not specify the final destination of the assets.

Binance’s reported replenishment and interception figures mark the principal response milestones in the available information. Further updates would be needed to show whether all affected assets were restored, how much remained frozen or intercepted, and whether the company’s technical review produced additional findings.

Related coverage: What is known about the $6.3 billion Binance crypto heist