{"schema_version":"0.10.0","id":"LR-2026-0842","record_version":20,"title":"Binance US$6.3bn hot-wallet theft following recruitment-lure intrusion and misuse of an internal AI tool","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":67.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-05","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"9 independent outlets","original_document":null,"reports_total":19,"reports_independent":9,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-05","history":[{"date":"2026-11-05","from_level":null,"to_level":"preliminary","reason":"1 report: Insurance Business · subject to change"},{"date":"2026-11-05","from_level":"preliminary","to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"cbe96825bd9b80daba4d9371db23b5cbe058593de9617c830532e61172df6928"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-10-29","date_disclosed":"2026-11-03","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A Binance software engineer was approached about a new job in September, and code he downloaded for a recruiter’s take-home test contained malicious code. A tampered AI coding assistant installer had earlier disclosed who worked on wallet systems. On 20 October, attackers used his laptop and an internal Binance AI tool to take over the computers of two wallet-team engineers. On 29 October they used stolen credentials to launch a container and run a script that moved funds out of hot wallets. Binance estimates the loss at US$6.3bn, and the FBI attributed the attack to TraderTraitor, which Pyongyang denies. About US$2.85bn has been frozen or intercepted. Withdrawals were suspended for almost two days and reopened on 1 November. The report does not state how the intrusion was detected. Binance says it has replaced about 95% of affected funds.","tags":["social-engineering","fake-recruitment","hot-wallet-theft","supply-chain-attack","credential-theft","north-korea-attribution"],"date_detected":null,"near_miss":false,"root_cause":"adversarial_input","root_cause_detail":"Malicious code in a downloaded coding assignment and a tampered installer carried the intrusion, as the report sequence describes.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"Downloaded coding assignment and tampered AI coding assistant installer","time_to_contain":null,"operations_paused":"Withdrawals suspended for almost two days and reopened on 1 November","remediation":null,"precursor_events":"First break-in in June via a tampered AI coding assistant installer that disclosed who worked on wallet systems"},"impact":{"direct_loss_usd":6300000000.0,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"severe","severity_because":"Severe under the dollar band: the stated loss estimate of about US$6.3bn is over 10M USD. The figure is Binance’s own estimate.","harm_class":["financial","operational"],"affected_description":"Binance customers whose withdrawals were suspended, and hot-wallet funds that were stolen","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":"partial","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.insurancebusinessmag.com/au/news/cyber/binances-us6-3bn-hack-began-with-a-fake-job-offer-and-it-had-no-cyber-cover-596041.aspx","publisher":"Insurance Business","date":"2026-11-04","type":"press","title":"Binance’s US$6.3bn hack began with a fake job offer, and it had no cyber cover","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html","publisher":"The Hacker News","date":"2026-11-03","type":"press","title":"Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://cryptonews.net/news/security/33698501/","publisher":"Cryptonews.net","date":"2026-11-04","type":"press","title":"Binance relied on AI to fight fraud before hackers exploited internal tool in $6 billion theft","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.pymnts.com/cybersecurity/2026/binance-reports-hackers-infiltrated-systems-months-before-stealing-6-billion-dollars/","publisher":"PYMNTS.com","date":"2026-11-03","type":"press","title":"Binance Reports Hackers Infiltrated Systems for Months Before Stealing $6.34 Billion | PYMNTS.com","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.hokanews.com/2026/11/binance-hack-timeline-reveals-how.html","publisher":"Hokanews","date":"2026-11-03","type":"press","title":"Binance Hack Timeline Reveals How Attackers Compromised Three Engineers to Access Wallet - Hokanews","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.theguardian.com/business/2026/nov/03/hackers-63bn-binance-heist-malware-bogus-job-interviews-cryptocurrency","publisher":"The Guardian","date":"2026-11-03","type":"press","title":"Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/","publisher":"BleepingComputer","date":"2026-11-03","type":"press","title":"Binance says fake job interview led to $6.3 billion crypto heist","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://www.thenationalnews.com/business/money/2026/11/03/binance-says-fake-job-interviews-and-internal-ai-tool-used-in-63bn-heist/","publisher":"The National","date":"2026-11-03","type":"press","title":"Binance says fake job interviews and internal AI tool used in $6.3bn heist | The National","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://cryptoticker.io/en/binance-hack-fake-job-interview/","publisher":"CryptoTicker.io","date":"2026-11-03","type":"press","title":"Binance hack began with a fake job interview","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.techflowpost.com/en-US/article/35096","publisher":"TechFlow","date":"2026-11-04","type":"press","title":"Binance Hacked for $6.34 Billion: Hackers Actually Had Their Own AI 'Open the Door' – How Did a Regular Employee's Comp…","archived_url":null,"attachment":"fingerprint"},{"url":"https://fintechnews.sg/140431/crypto/how-the-binance-6-billion-crypto-hack-happened/","publisher":"Fintech Singapore","date":"2026-11-04","type":"press","title":"From a Fake Recruiter to a US$6.3B Theft, Here's How the Binance Crypto Hack Happened - Fintech Singapore","archived_url":null,"attachment":"fingerprint"},{"url":"https://decrypt.co/382420/five-ways-north-korea-breaks-into-crypto-firms-and-how-binance-was-hacked","publisher":"Decrypt","date":"2026-11-03","type":"press","title":"Five Ways North Korea Breaks Into Crypto Firms—and How Binance Was Hacked - Decrypt","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://www.bankinfosecurity.asia/how-north-korean-hackers-interviewed-their-way-into-binance-a-33290","publisher":"bankinfosecurity.asia","date":"2026-11-04","type":"press","title":"How North Korean Hackers Interviewed Their Way Into Binance","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://www.safestate.com/post/binance-hack-traced-to-fake-job-interview-and-ai-tool-abuse","publisher":"Safestate","date":"2026-11-04","type":"press","title":"Binance Hack Traced to Fake Job Interview and AI Tool Abuse","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.pcmag.com/news/binance-traces-63b-hack-to-employee-duped-by-fake-job-interview","publisher":"PCMag","date":"2026-11-03","type":"press","title":"Binance Traces $6.3B Hack to Employee Duped by Fake Job Interview","archived_url":null,"attachment":"fingerprint"},{"url":"https://brusselssignal.eu/2026/11/binance-shares-details-of-e5-7-billion-crypto-heist/","publisher":"Brussels Signal","date":"2026-11-04","type":"press","title":"Binance shares details of €5.7 billion crypto heist","archived_url":null,"attachment":"fingerprint"},{"url":"https://www.helpnetsecurity.com/2026/11/04/binance-hack-north-korea-fake-job-interview/","publisher":"Help Net Security","date":"2026-11-04","type":"press","title":"Fake job interview opened the door to $6.34 billion Binance heist - Help Net Security","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://www.thevibes.com/index.php/articles/world/129152/hackers-infiltrated-binance-through-fake-job-interviews-compromised-ai-tools","publisher":"The Vibes","date":"2026-11-04","type":"press","title":"Hackers infiltrated Binance through fake job interviews, compromised AI tools","archived_url":null,"attachment":"fingerprint","independence":"independent"},{"url":"https://unn.ua/en/news/through-a-fake-job-interview-binance-reveals-details-of-the-largest-hack-in-cryptocurrency-history","publisher":"Українські Національні Новини (УНН)","date":"2026-11-04","type":"press","title":"Through a fake job interview: Binance reveals details of the largest hack in cryptocurrency history","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_occurred":"C","event.date_disclosed":"C","event.trigger":"D","event.detection_method":"D","event.summary":"C","event.tags":"C","event.near_miss":"C","event.root_cause":"C","event.root_cause_detail":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.operations_paused":"C","event.precursor_events":"C","event.incident_class":"C","impact.direct_loss_usd":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.reversibility":"C","impact.severity_because":"C","context.industry":"C","context.country":"D","context.denominator_available":"D","context.incident_evidence":"C"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals."}],"event.date_disclosed":[{"source_index":0,"quote":"The world’s biggest crypto exchange set out the sequence in an incident report published on 3 November."}],"event.summary":[{"source_index":0,"quote":"In September, a Binance software engineer was approached about a new job."},{"source_index":0,"quote":"The coding assignment he downloaded contained malicious code."},{"source_index":0,"quote":"A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems."},{"source_index":0,"quote":"On 20 October, the attackers used his laptop and an internal Binance AI tool to take over the computers of two engineers on the wallet team."},{"source_index":0,"quote":"Binance has not said what the tool does or how it was misused."},{"source_index":0,"quote":"On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals."},{"source_index":0,"quote":"US$6.3bn: Binance’s estimate of the loss, a record for a crypto theft"},{"source_index":0,"quote":"The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies any involvement."},{"source_index":0,"quote":"About US$2.85bn of the stolen assets has been frozen or intercepted, mostly stablecoins whose issuers can block transfers, according to blockchain tracing of the theft."},{"source_index":0,"quote":"Binance suspended withdrawals for almost two days and reopened them on 1 November."},{"source_index":0,"quote":"It says it has replaced about 95% of affected funds, while net outflows reached about US$4.7bn by 2 November."}],"event.tags":[{"source_index":0,"quote":"In September, someone posing as a project director at a non-existent company contacted a second engineer through a legitimate recruitment site."},{"source_index":0,"quote":"In September, a Binance software engineer was approached about a new job."},{"source_index":0,"quote":"On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals."},{"source_index":0,"quote":"A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems."},{"source_index":0,"quote":"The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies any involvement."}],"event.near_miss":[{"source_index":0,"quote":"Six weeks later, code he had downloaded for the recruiter’s take-home test helped attackers make off with about US$6.3bn, the largest crypto theft on record."}],"event.root_cause":[{"source_index":0,"quote":"The coding assignment he downloaded contained malicious code."}],"event.root_cause_detail":[{"source_index":0,"quote":"The coding assignment he downloaded contained malicious code."},{"source_index":0,"quote":"A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems."}],"event.adversarial_actor":[{"source_index":0,"quote":"The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies any involvement."}],"event.input_provenance":[{"source_index":0,"quote":"A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems."},{"source_index":0,"quote":"The coding assignment he downloaded contained malicious code."}],"event.operations_paused":[{"source_index":0,"quote":"Binance suspended withdrawals for almost two days and reopened them on 1 November."}],"event.precursor_events":[{"source_index":0,"quote":"The first break-in came in June."},{"source_index":0,"quote":"A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems."}],"event.incident_class":[{"source_index":0,"quote":"On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals."}],"impact.direct_loss_usd":[{"source_index":0,"quote":"Six weeks later, code he had downloaded for the recruiter’s take-home test helped attackers make off with about US$6.3bn, the largest crypto theft on record."}],"impact.severity":[{"source_index":0,"quote":"Six weeks later, code he had downloaded for the recruiter’s take-home test helped attackers make off with about US$6.3bn, the largest crypto theft on record."}],"impact.harm_class":[{"source_index":0,"quote":"Binance is covering the loss itself."},{"source_index":0,"quote":"Binance suspended withdrawals for almost two days and reopened them on 1 November."}],"impact.affected_description":[{"source_index":0,"quote":"the internet-connected wallets that process customer withdrawals."},{"source_index":0,"quote":"Binance suspended withdrawals for almost two days and reopened them on 1 November."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"On 29 October, they used stolen credentials to launch a container and run a script that moved funds out of Binance’s hot wallets, the internet-connected wallets that process customer withdrawals."}],"impact.reversibility":[{"source_index":0,"quote":"About US$2.85bn of the stolen assets has been frozen or intercepted, mostly stablecoins whose issuers can block transfers, according to blockchain tracing of the theft."},{"source_index":0,"quote":"It says it has replaced about 95% of affected funds, while net outflows reached about US$4.7bn by 2 November."}],"impact.severity_because":[{"source_index":0,"quote":"Six weeks later, code he had downloaded for the recruiter’s take-home test helped attackers make off with about US$6.3bn, the largest crypto theft on record."},{"source_index":0,"quote":"US$6.3bn: Binance’s estimate of the loss, a record for a crypto theft"}],"context.industry":[{"source_index":0,"quote":"The world’s biggest crypto exchange set out the sequence in an incident report published on 3 November."}],"context.incident_evidence":[{"source_index":0,"quote":"The world’s biggest crypto exchange set out the sequence in an incident report published on 3 November."}]},"notes_on_gaps":"The document is a press account of a company incident report. No model, developer, harness, or tool capability for the internal AI tool is stated, and Binance has not said what the tool does, so agent_involved and failure_class are null and autonomy is unknown. The trigger is not named in any enum-matching source, so it is unknown; the recruitment lure and tampered installer are recorded as precursor and provenance facts. The first break-in has only a month (June). The 29 October date is given without a year; the year 2026 is taken from the article metadata and the statement that 57 attacks were blocked 'this year'. The year for the 3 November report is likewise taken from metadata. Detection method and date detected are not stated. Root cause adversarial_input is a grade D judgement from the malicious downloads. Responsible party is not stated. Loss is Binance's own estimate. Insurance status is reported second-hand via Bloomberg Law: no cyber cover, D&O cover held, and Binance has not commented, so coverage posture is unknown and not recorded. Statements about specie, crime and war exclusions are generic market commentary, not Binance's policy wording. Records exposed and affected third-party count are not stated. Duration of the failure state is not stated beyond the withdrawal suspension. The 95% replacement figure is a company claim. Extractor proposed values without quotes; dropped: ['event.detection_method', 'event.trigger', 'system.autonomy_level', 'system.developer']. Single secondary source; corroborate before upgrading any field to B. [2026-11-05: evidence level set: Preliminary (1 report: Insurance Business · subject to change)] [2026-11-05: source attached: https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html (fingerprint); Both describe the Binance $6.3bn hot-wallet theft of 29 October that began with a fake job-offer lure and involved stolen credentials and an internal AI tool, so it is the same act on the same target.] [2026-11-05: evidence level: Preliminary → Confirmed (2 independent outlets)] [2026-11-05: source attached: https://cryptonews.net/news/security/33698501/ (fingerprint); Both describe the Binance $6.3bn hot-wallet theft of 29 October that began with a fake job-offer lure and involved stolen credentials and an internal AI tool, so it is the same act on the same target.] [2026-11-05: evidence level recomputed: Confirmed (2 independent outlets)] [2026-11-05: source attached: https://www.pymnts.com/cybersecurity/2026/binance-reports-hackers-infiltrated-systems-months-before-stealing-6-billion-dollars/ (fingerprint); Both describe the Binance $6.3bn hot-wallet theft of 29 October that began with a fake job-offer lure and involved stolen credentials and an internal AI tool, so it is the same act on the same target.] [2026-11-05: evidence level recomputed: Confirmed (2 independent outlets)] [2026-11-05: source attached: https://www.hokanews.com/2026/11/binance-hack-timeline-reveals-how.html (fingerprint); Both describe the Binance $6.3bn hot-wallet theft of 29 October that began with a fake job-offer lure and involved stolen credentials and an internal AI tool, so it is the same act on the same target.] [2026-11-05: evidence level recomputed: Confirmed (2 independent outlets)] [2026-11-05: source attached: https://www.theguardian.com/business/2026/nov/03/hackers-63bn-binance-heist-malware-bogus-job-interviews-cryptocurrency (fingerprint); Both describe the Binance $6.3bn hot-wallet theft of 29 October that began with a fake job-offer lure and involved stolen credentials and an internal AI tool, so it is the same act on the same target.] [2026-11-05: evidence level recomputed: Confirmed (3 independent outlets)] [2026-11-05: source attached: https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/ (fingerprint); The report describes the same fake-recruiter intrusion and October 29 hot-wallet theft of about $6.3bn with an internal AI tool, matching LR-2026-0842 rather than the later laundering incident LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (4 independent outlets)] [2026-11-05: source attached: https://www.thenationalnews.com/business/money/2026/11/03/binance-says-fake-job-interviews-and-internal-ai-tool-used-in-63bn-heist/ (fingerprint); Both describe the Binance $6.3bn hot-wallet theft that began with a fake job-offer lure to an engineer and involved an internal AI tool, whereas LR-2026-0289 concerns the laundering of the proceeds.] [2026-11-05: evidence level recomputed: Confirmed (5 independent outlets)] [2026-11-05: source attached: https://cryptoticker.io/en/binance-hack-fake-job-interview/ (fingerprint); The report describes the same Binance October 29 hot-wallet theft that began with a fake hiring lure and involved an internal AI tool, matching LR-2026-0842 rather than the laundering-focused LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (5 independent outlets)] [2026-11-05: source attached: https://www.techflowpost.com/en-US/article/35096 (fingerprint); Same Binance hot-wallet theft via fake job interview, internal AI tool misuse, and October 29 container launch; the report and card describe the same act on the same target, while LR-2026-0289 is about laundering of the funds afterward.] [2026-11-05: evidence level recomputed: Confirmed (5 independent outlets)] [2026-11-05: source attached: https://fintechnews.sg/140431/crypto/how-the-binance-6-billion-crypto-hack-happened/ (fingerprint); Both describe the same Binance US$6.3bn theft via a fake recruitment lure, malicious code on an engineer's machine, and the 29 October container deployment using stolen credentials.] [2026-11-05: evidence level recomputed: Confirmed (5 independent outlets)] [2026-11-05: source attached: https://decrypt.co/382420/five-ways-north-korea-breaks-into-crypto-firms-and-how-binance-was-hacked (fingerprint); The report describes the same Binance intrusion via a fake job lure, misuse of an internal AI tool, and the October 29 container deployment using stolen credentials to move hot-wallet funds, matching LR-2026-0842 rather than the laundering-focused LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (6 independent outlets)] [2026-11-05: source attached: https://www.bankinfosecurity.asia/how-north-korean-hackers-interviewed-their-way-into-binance-a-33290 (fingerprint); The report describes the same Binance hot-wallet theft of about $6.3 billion that began with a fake job lure and malicious test download and involved an internal AI tool, matching LR-2026-0842 rather than the laundering-focused LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (7 independent outlets)] [2026-11-05: source attached: https://www.safestate.com/post/binance-hack-traced-to-fake-job-interview-and-ai-tool-abuse (fingerprint); Both describe the same Binance hot-wallet theft of about $6.3bn on 29 October, reached via a fake-job recruitment lure and misuse of an internal AI tool, whereas LR-2026-0289 is about AI-assisted laundering of the stolen funds, a different act.] [2026-11-05: evidence level recomputed: Confirmed (7 independent outlets)] [2026-11-05: source attached: https://www.pcmag.com/news/binance-traces-63b-hack-to-employee-duped-by-fake-job-interview (fingerprint); The report describes the same Binance $6.3B theft that began with a fake job interview lure and a malicious assignment downloaded by an engineer, matching LR-2026-0842 and its internal AI tool misuse, rather than the laundering-focused LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (7 independent outlets)] [2026-11-05: source attached: https://brusselssignal.eu/2026/11/binance-shares-details-of-e5-7-billion-crypto-heist/ (fingerprint); Both describe the same Binance hot-wallet theft of late October 2026 that began with a fake-job coding assignment delivered to an engineer and ended with misuse of an internal AI tool to move funds.] [2026-11-05: evidence level recomputed: Confirmed (7 independent outlets)] [2026-11-05: source attached: https://www.helpnetsecurity.com/2026/11/04/binance-hack-north-korea-fake-job-interview/ (fingerprint); Both describe the same Binance recruitment-lure intrusion and misuse of an internal AI tool leading to the October 29 hot-wallet theft, whereas LR-2026-0289 concerns the separate laundering of the funds.] [2026-11-05: evidence level recomputed: Confirmed (8 independent outlets)] [2026-11-05: source attached: https://www.thevibes.com/index.php/articles/world/129152/hackers-infiltrated-binance-through-fake-job-interviews-compromised-ai-tools (fingerprint); The report describes the same Binance recruitment-lure intrusion, internal AI tool misuse and US$6.3bn theft as LR-2026-0842, whereas LR-2026-0289 concerns laundering of the stolen funds.] [2026-11-05: evidence level recomputed: Confirmed (9 independent outlets)] [2026-11-05: source attached: https://unn.ua/en/news/through-a-fake-job-interview-binance-reveals-details-of-the-largest-hack-in-cryptocurrency-history (fingerprint); The report describes the same Binance $6.3B hot-wallet theft that began with a fake job-offer lure to an engineer and involved misuse of an internal AI tool, matching LR-2026-0842 rather than the laundering-focused LR-2026-0289.] [2026-11-05: evidence level recomputed: Confirmed (9 independent outlets)] [2026-11-05: re-scored after its sources changed: 67.5]"},"context":{"industry":"Cryptocurrency exchange","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":null,"tamper_evidence":null,"timestamp_reliability":null,"investigation_independence":"internal","redaction_summary":null,"analysis_method":null,"prompt_output_retention":null},"regulatory":null,"coverage":null}}