Binance's $6.3 Billion Hack: An Attack That Lurked for Four Months, Involving Fake Recruiting and Internal AI Tools Working Together

Binance suffered a roughly $6.3 billion hot-wallet breach on Oct. 29, 2026, the largest crypto theft on record and about four times Bybit's $1.4 billion loss in February 2025, with stolen assets spanning Bitcoin, Ethereum, Solana, XRP and other chains. Binance's preliminary report said hackers spent four months infiltrating internal systems—via a tampered AI coding-tool installer in June, a fake job interview and malicious coding test in September, and lateral movement through an internal AI tool that yielded a high-privilege token—before using signing-service access to authorize fraudulent withdrawals. Tether and Circle froze nearly $3 billion in stablecoins within minutes, and DeFi protocols including Aave halted laundering routes, while Binance covered 98% of the loss through its SAFU fund and reserves. User funds were unaffected and secondary market prices absorbed the shock with little disruption. The case, attributed to North Korean actors, puts exchange endpoint security, hiring-channel hygiene and internal AI tool permissions under scrutiny as the industry reassesses defense-in-depth.