Binance said on 3 November that the attackers behind its 29 October security incident used “an internal AI tool” as “a springboard” on the way to its wallets. In its initial findings, posted on X, the exchange says approximately USD 6.34 billion in digital assets were impacted and approximately USD 2.85 billion have been frozen or intercepted.
By our arithmetic, $2.85 billion is 45% of $6.34 billion, leaving about $3.49 billion not frozen or intercepted as of the update. Binance says it “will absorb the financial impact of the stolen funds, not our users”.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least-privilege access. It explains the general idea only and does not discuss Binance.
The key insight: Binance says an internal AI tool was the step between one compromised work computer and control over two wallet engineers, nine days before about $6.34 billion in digital assets were impacted; by our arithmetic, the $2.85 billion frozen or intercepted is 45% of that.
Binance calls the attack “a sophisticated, multi-stage campaign” and says it “was not a single isolated breach or a simple phishing incident”. It lists the techniques the attackers combined: “social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method”.
The exchange says the latest information released by the Federal Bureau of Investigation indicates that North Korea is responsible, which we covered in FBI Ties $6B Binance Hack to North Korea in Two Days. Binance says that throughout 2026 its security team detected and prevented 57 suspected North Korea-linked cyber threat cases.
Stages of the 29 October incident as Binance dates them in its 3 November initial findings. The nine days between the internal AI tool step and the theft, and the 3 hour 51 minute transfer window, are our arithmetic. Chart: FourWeekMBA.
What Was Posted on X
HOLY SHIT. Binance says hackers used a fake job interview to compromise a computer, then exploited its own internal AI tool to take control of wallets in the $6.3 BILLION heist.
Now Binance is increasing AI-powered security and working on new initiatives with leading AI companies.
Choblin (@choblin29) posted this at 15:22 UTC on 3 November, quoting Binance’s X post that links its initial findings. The post summarises Binance’s account of the fake job interview, the internal AI tool and the AI security initiatives; the figures and quotes in this piece come from Binance’s article itself.
The Internal AI Tool Step
Binance dates the campaign in stages. In September, it says, a software engineer was approached through a legitimate job-hunting platform and, in a second-round interview, was instructed to download an “assignment” onto his work computer; the repository contained malicious code. Binance says the malware “was not detected by the endpoint security protection tools at the time”.
On 20 October, according to Binance, the attacker used that engineer’s compromised computer and “used an internal AI tool to gain control over” two engineers on its wallet team, one of whom had a container deployment permission token on his computer. On 29 October, between 17:15 and 19:56 (Binance gives no time zone for these two times), the exchange says the attacker used those credentials to deploy a container and launch the attack. By our arithmetic, nine days passed between the AI-tool step and the theft.
Binance does not name the internal AI tool or say what it is used for. Its list of fixes includes “Rebuilt the affected internal AI tool and access controls”.
How the Funds Moved
Binance says the attacker “exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process”. The first transfers left five Binance hot wallets between 20:05 and 20:09 UTC, and the final unauthorized transfer finalised on-chain at 23:56 UTC. By our arithmetic, that is a window of 3 hours 51 minutes.
Binance says suspending withdrawals “could not stop all unauthorized asset movements”, because on-chain authorizations created through an Ethereum mechanism, EIP-7702, operated independently of its withdrawal infrastructure. It cleared the last of them at 00:10 UTC on 30 October.
Who Pays
Binance says it has set aside “more than 100% of the funds required to cover the loss” and that, as of 31 October, 98% of the impacted token assets had been replenished and are verifiable on its Proof of Reserves page. It says it is buying the remaining, more illiquid assets.
When we first reported the theft in Binance Hack Moves $6.36B, TRM Labs had traced about $6.36 billion and about $2.7 billion frozen, 42% by our arithmetic then. Binance’s own figures, approximately $6.34 billion and $2.85 billion, put the frozen share at 45%.
What Binance Says It Will Do
Binance lists three further steps: an independent cybersecurity review, “Expanded investment in AI security and prevention”, and a security research fund with “targeted initiatives with leading AI companies, industry participants and security firms focused on AI security in blockchain environments”. It does not name the AI companies.
As we read Binance’s timeline, the internal AI tool sat between the two parts of the attack: the fake job interview gave the attacker one engineer’s computer, and the AI tool step, in Binance’s words, was used “to gain control over” two engineers on its wallet team.
As we read the cost, Binance has put the bill on its own balance sheet: it says it set aside more than 100% of the funds required and had replenished 98% of the impacted token assets by 31 October, while $3.49 billion, by our arithmetic, was not frozen or intercepted as of the update.
Binance, initial findings, 3 November 2026
“The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method”
Three Implications
FOR INTERNAL AI TOOLS Binance lists “Rebuilt the affected internal AI tool and access controls” among its fixes; it does not say what the tool is or what access it held.
FOR THE LOSS Binance says it absorbs the financial impact, not its users; by our arithmetic, $3.49 billion of the approximately $6.34 billion was not frozen or intercepted as of the update.
FOR AI SECURITY SPENDING Binance says it is increasing investment in AI-enabled detection and endpoint protection and working on initiatives with leading AI companies, which it does not name.
The framework says “The surface, not the model, governs autonomy.”
As we read it, Binance’s findings put an internal AI tool on that surface: what the tool could reach inside the company mattered in the attack path Binance describes. The framework is the owner’s argument and does not discuss Binance or this incident.
These are Binance’s initial findings. The exchange says the investigation is ongoing, its findings will be subject to further independent review, and some technical details will remain confidential. It does not say what the internal AI tool is, who built it, or what access it held.
The dollar figures are Binance’s and, it says, subject to reconciliation and market price volatility. TRM Labs earlier traced about $6.36 billion and about $2.7 billion frozen; the two sets of figures use different dates and methods. We did not contact Binance.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
Binance says a fake job interview in September, an internal AI tool on 20 October and stolen deployment credentials on 29 October led to about $6.34 billion in digital assets being impacted; $2.85 billion, 45% by our arithmetic, has been frozen or intercepted, and Binance says it covers the loss.
A note on sourcing. The facts and quotes come from Binance’s initial findings, published as an X article on 3 November 2026 and linked from its post at 14:33 UTC; the item reached us through a post by Choblin on X. TRM Labs and FBI figures are from our earlier pieces. Percentages, the nine-day gap and the transfer window are our arithmetic. We describe the attack only at the level Binance itself gives. We did not contact Binance.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
