What happened
Binance described the incident at a media briefing reported by CoinDesk on November 3, 2026. CEO Richard Teng said the attack was “a campaign, built over many months,” and said the FBI attributed it to North Korea. Binance’s chief security officer Jimmy Su recounted two initial access paths. In September, a software engineer was contacted through a legitimate job platform by someone posing as a project director. A fake HR representative conducted a video interview and shared a social-media account with personal photos to build trust. A second interview, with someone claiming to be a CEO, ended with a request to download a coding assignment onto the engineer’s work computer. Binance said the assignment contained zero-day malware that evaded endpoint security.
The company also said that in June another engineer had installed a tampered Homebrew package while looking for an AI tool. Binance detected the compromise and replaced that device, but said the engineer and colleagues on the wallet team remained exposed. On October 20, attackers used the machine compromised through the fake interview and an internal AI tool to reach two wallet engineers’ computers, according to Su. On October 29, they used stolen credentials to deploy a container and run a malicious script. Funds started moving at 20:05 UTC.
Su said attackers used Ethereum’s EIP-7702 feature to obtain execution rights over a hot wallet. Binance’s hot wallets use multiparty computation, so, according to the company, no single key could revoke those rights. Containment took until 00:10 UTC on October 30. CoinDesk links to a separate article describing the EIP-7702 permission mechanism, but the supplied briefing account does not give a more detailed technical reconstruction of how the exploit was executed.
Teng said approximately $2.85 billion had been frozen and about 98% of affected tokens replenished with company funds, adding that users would not be affected. Binance said it had blocked 57 suspected North Korea-linked attempts that year and planned to bring in independent cybersecurity experts to review the incident. The account does not specify a review timetable or publish its findings.
What the archive adds
This is a further report on an already covered incident, not a new event. North Korea used LinkedIn to trick Binance engineer in $6.3 billion hack covered the fake interview and theft. A later archive note, Binance resumes withdrawals after billions stolen in hack, records service restoration. This CoinDesk briefing adds the company’s account of the multi-month campaign, the internal AI tool’s role in lateral movement, and figures on frozen and replenished funds.
Trend signal
This case supports agent security moves to runtime boundaries: security depends on controlling what compromised devices, credentials, tools and execution permissions can reach, not only on asking software or agents to behave safely. The story does not establish that an AI agent itself was compromised; the relevant signal is that an internal AI tool was part of the path attackers used to reach wallet engineers’ computers.
Why now
Binance’s November 3 briefing supplied a more detailed account of the intrusion path after funds began leaving on October 29 and containment ended on October 30. The timing matters because it turns a reported theft into a specific chain of employee targeting, developer-device compromise and wallet permission abuse. The supplied source does not say when the independent review will report.
Why it matters
For teams building with AI, “internal AI tool” should be treated as part of the security architecture, not as a harmless convenience outside the threat model. Binance’s account connects a social-engineering compromise to lateral movement across employee systems and ultimately to a hot-wallet capability. That is a reminder to limit what internal tools can access, separate the identities and permissions of development and financial systems, and assume that a compromised endpoint may expose more than the files on that machine.
The practical point is not that AI tools caused this theft. The account says attackers used an internal AI tool as one step in reaching wallet engineers’ computers; it does not describe that tool’s design or vulnerability. Still, builders should inventory integrations and permissions around internal assistants, alongside package provenance and endpoint defenses. A human review of a coding assignment is not enough if the downloaded code runs on a work device with access to sensitive colleagues or systems. Earlier coverage: North Korea used LinkedIn to trick Binance engineer in $6.3 billion hack.
Limits and uncertainty
The account is Binance’s description of the incident, relayed by CoinDesk, and it does not provide an independent forensic report. The source does not identify the internal AI tool, explain what access it had, or say precisely how it enabled movement to the two wallet engineers’ computers. It also does not detail the malware, the stolen credentials, the EIP-7702 transaction sequence, or whether the June and September compromises were operated by the same actors. The FBI attribution is reported as Binance’s statement, not as a separately quoted FBI assessment. The figures on frozen assets and replenished tokens are likewise Binance’s reported figures; the source does not show an audit or explain the calculation behind the $6.3 billion headline amount.
Reader takeaway
The central lesson is about boundaries: a recruiting interaction and a developer tool can become the first links in a path toward privileged systems. Treat employee devices, downloaded code, internal assistants and wallet permissions as connected attack surfaces, and constrain each one so that a single compromise cannot quietly reach the next.
Open question
What will the independent cybersecurity review disclose about the internal AI tool’s role and the controls that failed?