AI Risk Wire

Cases › security breach › LR-2026-0842

Binance US$6.3bn hot-wallet theft following recruitment-lure intrusion and misuse of an internal AI tool

Also listed as: AI cyberattacks

Confirmed Why: 9 independent outlets · 9 independent reports

Evidence level history

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity severe
Money lost or records count US$6,300,000,000
Reported 3 Nov 2026
Industry Cryptocurrency exchange

No source states: developer and model, could do, deployer.

Severity severe: under the dollar band: the stated loss estimate of about US$6.3bn is over 10M USD. The figure is Binance’s own estimate.

A Binance software engineer was approached about a new job in September, and code he downloaded for a recruiter’s take-home test contained malicious code. A tampered AI coding assistant installer had earlier disclosed who worked on wallet systems. On 20 October, attackers used his laptop and an internal Binance AI tool to take over the computers of two wallet-team engineers. On 29 October they used stolen credentials to launch a container and run a script that moved funds out of hot wallets. Binance estimates the loss at US$6.3bn, and the FBI attributed the attack to TraderTraitor, which Pyongyang denies. About US$2.85bn has been frozen or intercepted. Withdrawals were suspended for almost two days and reopened on 1 November. Binance says it has replaced about 95% of affected funds.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary98 incidents
Rising: 25 vs 4.0 a week
AI system attacked or breached
Also21 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Similar incidents

Alleged $6.3B Binance exploit funds laundered via automated, AI-assisted transaction patterns2026-10-30

All cases of this kind ›

Evidence

No source states: a step-by-step account, when it was found, how many records were exposed, a count of the other parties affected, any court case, what set it off, what was done.

Show every field, with its source and grade

What happened

When it happened
2026-10-29
C one secondary source states it
Earliest source we hold
2026-11-03
C one secondary source states it
Themes
social engineering, fake recruitment, hot wallet theft, supply chain attack, credential theft, north Korea attribution
C one secondary source states it
Cause
hostile input carried instructions
C one secondary source states it
Cause in detail
Malicious code in a downloaded coding assignment and a tampered installer carried the intrusion, as the report sequence describes.
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
Downloaded coding assignment and tampered AI coding assistant installer
C one secondary source states it
What was stopped
Withdrawals suspended for almost two days and reopened on 1 November
C one secondary source states it
Earlier warning signs
First break-in in June via a tampered AI coding assistant installer that disclosed who worked on wallet systems
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Direct loss
$6,300,000,000
C one secondary source states it
Severity
severe
C one secondary source states it
Kind of harm
money, operations
C one secondary source states it
Who was affected
Binance customers whose withdrawals were suspended, and hot-wallet funds that were stolen
C one secondary source states it
Kinds of data exposed
credentials
C one secondary source states it
Can it be undone
partly
C one secondary source states it
Why this severity
under the dollar band: the stated loss estimate of about US$6.3bn is over 10M USD. The figure is Binance’s own estimate.
C one secondary source states it

Context

Industry
Cryptocurrency exchange
C one secondary source states it
Investigated
by the organisation itself
C one secondary source states it

Notes on gaps

The document is a press account of a company incident report. The first break-in has only a month (June). The year for the 3 November report is likewise taken from metadata. Loss is Binance's own estimate. Insurance status is reported second-hand via Bloomberg Law: no cyber cover, D&O cover held, and Binance has not commented, so coverage posture is unknown and not recorded. Statements about specie, crime and war exclusions are generic market commentary, not Binance's policy wording. The 95% replacement figure is a company claim. Extractor proposed values without quotes; dropped: .

LR-2026-0842 · version 20 · published 2026-11-05 after automatic checks; not yet checked field by field by a person · changes to this case · JSON