Binance links $6.34 billion crypto theft to fake interviews and malware in November 3 update
Binance describes how attackers reached its wallet systems and reports progress replacing assets after the October 29 theft, with some withdrawals restricted.
Binance disclosed on November 3, 2026, that attackers used fake job interviews, malware and compromised internal AI tools to penetrate its cryptocurrency wallet infrastructure before the October 29 theft. CNBC reported the company's explanation of an attack that took more than $6 billion from its systems. [1]
The Guardian separately reported Binance's November 3 account, describing bogus recruitment interviews, malicious software and an internal AI tool as elements of the operation behind the approximately $6.3 billion heist. These are reported explanations from Binance; publication by two outlets does not make the company's technical findings an independently verified forensic conclusion. [2]
What Binance disclosed on November 3
The new development is Binance's explanation of how its defences were breached. According to the company account reported by The Guardian, the operation began with a malware download in June, developed into a recruitment scam in September and ultimately reached the exchange's hot wallets, where the crypto assets were held. [2]
Binance co-CEO Richard Teng told CNBC on November 3 that the attackers had worked over several months to gain access. He rejected an explanation centred on a single employee's laptop. [1]
How the attackers reached wallet systems
The June incident involved a Binance Wallet DevOps engineer downloading a tampered Homebrew installation while trying to install an AI coding tool found through a search engine, according to Binance's security report as described by CNBC. [1]
The later recruitment approach targeted a different engineer. The Guardian reported that a fictitious project director made contact through a legitimate job platform. A video interview with someone posing as an HR representative was followed by an interview on a chat app with a supposed chief executive. Binance's account says the engineer downloaded malware during that second interview. [2]
The company's timeline then identifies two October dates. On October 20, the attacker used the compromised computer and an internal AI tool to gain control of systems belonging to that engineer and another wallet developer. On October 29, the attacker used the second developer's computer, credentials stolen from the first engineer and a malicious script to launch the theft, The Guardian reported. [2]
Frozen funds and replenished assets are different measures
Binance said $2.85 billion of the $6.34 billion drained from its wallets had been frozen or intercepted, according to The Guardian. That wording describes funds blocked or caught during the response. The passage does not establish that all of those assets had been returned to Binance or made available to customers by November 3. [2]
Were all stolen assets recovered?
Separately, Teng told CNBC that Binance had replenished 98% of the $6.34 billion in affected assets. He said purchases of the remaining, less liquid assets were continuing. This is a statement about replacing affected holdings; it does not establish that investigators had recovered 98% of what the attackers stole. [1]
Have all withdrawal restrictions ended?
For customers, CNBC reported a more immediate operational consequence: Binance had temporarily restricted certain withdrawals. The exchange also pledged to cover all customer losses and used its own reserves to replenish assets. The supplied passage does not specify every affected asset, account or withdrawal route, or provide a date when all restrictions would end. [1]
Binance maintained that it remained financially sound while working to identify the vulnerability, recover funds and prevent another attack, CNBC reported. That is the exchange's assessment of its position. The passage does not provide an independent financial assessment sufficient to establish that all consequences of the breach had been resolved. [1]
Disputed responsibility
Responsibility for the attack remains an attributed allegation in the supplied reporting. The Guardian reported that the FBI blamed North Korea on October 31. That passage establishes the FBI's position; it does not itself supply the underlying investigative evidence on which the attribution rested. [2]
North Korea disputed the accusation. The Guardian reported that North Korea called the accusation “absurd rhetoric” on November 3. That response represents North Korea's denial, rather than an independent determination of who conducted the attack. [2]
Questions for Canadian readers
Does the reporting establish losses for Canadian customers?
No Canadian customer-loss figure or Canada-specific withdrawal impact is established in the supplied account of customer restrictions and reimbursement commitments. Canadian readers can identify the exchange's reported operational response, but that passage does not support a conclusion about how many Canadians were affected or what any individual Canadian account experienced. [1]
Reporting checked at 2026-11-03 20:23 UTC. This article summarises dated reports; any share-price movements described are historical observations, not live quotes.
This article is general information, not personal financial advice.
