Incident 1817: Hackers Reportedly Used Internal AI Tool in $6.34 Billion Breach of Cryptocurrency Exchange Binance

Responded

Description: Cryptocurrency exchange Binance reported that attackers used a compromised internal AI tool to gain control of additional developer workstations before using stolen credentials to reach wallet-signing infrastructure. The exchange said approximately $6.34 billion in digital assets were affected, of which $2.85 billion was frozen or intercepted. The FBI attributed the attack to North Korean hackers. The precise AI-tool exploit mechanism was not disclosed.

Editor Notes: 06/2026: A wallet engineer reportedly downloaded a tampered Homebrew installer while trying to install an AI coding tool; Binance detected and remediated that infection. 09/2026: Another engineer reportedly ran malicious code from a bogus recruitment exercise. 10/20/2026: Attackers reportedly used a compromised internal AI tool to access two additional engineers' workstations. 10/29/2026: Attackers reportedly used stolen credentials and wallet-signing access to transfer digital assets; Binance began containment. 10/31/2026: The FBI attributed the theft to North Korean TraderTraitor activity. 11/03/2026: Binance issued its initial findings and response update. 11/09/2026: Palo Alto Networks published a technical analysis. 11/12/2026: Incident ID created.

Tools

New Report New Response DiscoverView History

Entities

View all entities

Alleged: AI agent system developers and AI software developers developed an AI system deployed by North Korean threat actors , Threat actors , Cybercriminals , hackers , Government of North Korea and AI agent system deployers, which harmed Binance , Cryptocurrency exchanges and Cryptocurrency wallet owners.

Alleged implicated AI systems: Binance internal AI developer tool , AI agent systems , Cryptocurrency wallet infrastructure and Cryptocurrency wallets

Incident Stats

Incident ID

1817

Report Count

Incident Date

2026-10-29

Editors

Daniel Atherton

Incident Reports

Reports Timeline

North Korea Responsible for $6 Billion+ Binance Attack

fbi.gov

29 October 2026 Binance Security Incident: Initial Findings and Response Update

binance.com

Binance hackers used fake job interview in $6.3 billion attack

reuters.com

How a Developer Endpoint Became the Path to Binance’s $6.3B Heist

paloaltonetworks.com

fbi.gov · 2026

Federal Bureau of Investigation post-incident response

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Bin…

binance.com · 2026

Binance post-incident response

On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.

…

reuters.com · 2026

PARIS/DETROIT, Nov 3 (Reuters) - Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third's computer to drain $6.3 billion worth of crypto…

paloaltonetworks.com · 2026

Could the largest crypto heist in history have been prevented?

By analyzing the telemetry, timeline, and attack vectors disclosed in Binance’s post-incident report1, one conclusion stands out: the attackers should never have made it past th…

Variants

A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.

Seen something similar?

Previous Incident Next Incident