We all know not to click the link from the “prince” who wants to share his fortune. But nobody warned us about the charming recruiter on a real job site, the polite HR manager on video, and the CEO who just needs you to finish one small coding exercise before the offer comes through.

That, according to Binance, is roughly how the biggest crypto heist on record began. On October 29, attackers drained about US$6.3 billion from the world’s largest crypto exchange, and on November 3 Binance said the trail led back to a fake job interview and a hijacked internal AI tool. Legally, it raises three questions: who pays, what counts as “reasonable” security now, and who answers for an AI tool turned against its owner.

How did a fake job interview lead to the Binance hack?

Here is the sequence Binance described in its initial incident account. In September, one of its engineers was approached on a legitimate recruitment platform by someone posing as a project director. Video interviews followed with a supposed HR representative and the supposed CEO of a company that didn’t exist. Near the end, the engineer was asked to download an “assignment” repository onto a work computer.

The setup quietly swapped a common developer tool for a compromised version, and Binance says its endpoint security missed it. On October 20, the attacker used that foothold, plus an internal AI tool, to take over two wallet engineers’ computers, one holding a deployment token. On October 29, that token was used to run a script that reached Binance’s wallet signing operations. Binance has said it found no evidence that wallet private keys were compromised.

As for who did it: the FBI said on October 31 that the theft was the work of North Korean actors it calls TraderTraitor, the same label it gave the group behind last year’s US$1.5 billion Bybit hack, according to the Associated Press. That is the FBI’s assessment, not a court finding.

Here’s the part that stings. In September 2024, the FBI published a public service announcement warning that North Korean actors were targeting crypto employees with fake job offers and “pre-employment tests” that involve running unfamiliar code. Its advice: don’t run those tests on company devices. Two years later, that’s more or less the script that played out.

Who pays when a crypto exchange is hacked?

Binance’s answer is: we do. Co-CEO Richard Teng said the exchange will “take full responsibility” and that no user bears the loss, and Binance says it replenished most of the affected assets within days while about US$2.85 billion was frozen or intercepted.

Customers should be relieved. But that promise is a commercial decision by a company with deep pockets and a reputation to protect, not a legal guarantee every platform owes every customer. What you can recover after a hack usually depends on the platform’s terms of use, where it is regulated, and whether a court would find it failed to take reasonable care. A smaller exchange might simply not have the money, and terms of service written by the platform’s lawyers rarely volunteer to carry the risk.

That is where the FBI’s 2024 warning matters. Negligence law generally asks whether a harm was foreseeable and whether sensible precautions were taken. When a government agency has publicly described the exact tactic and how to defend against it, foreseeability isn’t really up for debate. In my view, security teams should treat published advisories as part of the standard of care, because sooner or later a plaintiff’s lawyer will.

Your hiring process is now a security system

The temptation after a breach is to find someone to blame, and the engineer who took the interview is an easy target. Wrong lesson. That engineer was the victim of a patient operation that built an entire fake company to fool them. Firing people for being fooled doesn’t make the next person less foolable, just less likely to report it.

The better lesson is structural. Recruitment, on both sides of the table, is now an attack surface. That means clear rules for work devices (no third-party “assignments” on a laptop that can touch production, ever), sandboxed machines for any code someone has to run, and training that treats unsolicited job offers the way we already treat suspicious invoices. Write your workplace technology policies for the threats that actually exist, not the ones from a 2015 slide deck.

What happens when your own AI tool helps the hacker?

This is the detail I keep coming back to. Binance says the attacker used an internal AI tool to hop from one compromised laptop to two more engineers’ computers. Binance has since rebuilt it and tightened access controls.

Companies give internal AI assistants broad access to code, systems and credentials because that’s what makes them useful. But an AI tool with wide permissions is like a new hire handed every key in the building on day one, with no probation period. Whoever gets hold of it gets the keys too. I wrote about how our laws lag behind this kind of risk in my AI safety series, and this is a very expensive illustration.

I don’t see any regulator or court accepting “the AI did it” as a defence. Responsibility sits with the business that deployed the tool and decided what it could reach. So apply the rules we use for human staff to AI agents: least privilege, logging, approvals for anything sensitive, and a named person accountable for what the tool can do.

Does this affect Canadians?

Directly, less than you might think. Binance announced in May 2023 that it was leaving Canada, citing new guidance from securities regulators. In May 2024, FINTRAC imposed a penalty of $6,002,000 on Binance Holdings for failing to register as a foreign money services business and failing to report large virtual currency transactions. Platforms serving Canadians under the securities regulators’ regime have committed to safeguards such as holding at least 80% of client crypto with a third-party custodian, segregated and in trust.

Indirectly, there’s a bigger question. Canada’s Critical Cyber Systems Protection Act (Bill C-8), which received Royal Assent in June, imposes security and incident-reporting duties on designated operators in finance, telecommunications, energy and transportation. The government’s announcement doesn’t mention crypto. As exchanges grow to the size of banks, policymakers should ask whether the biggest belong inside regimes like this. (I broke down what Bill C-8 means for you here.)

So what should you do?

If you hold crypto: check whether your platform is registered to serve Canadians, read what its terms say about security losses, and don’t assume every exchange can, or will, make you whole.

If you’re job hunting: be wary of any “take-home test” that asks you to run code, especially on a work device. A real employer can wait while you verify who they are.

If you run a business, legal team or security function: test your controls against the FBI’s 2024 advisory, ban third-party code on production-connected devices, and audit what your internal AI tools can reach. Then check how your contracts and terms allocate the risk if it all goes wrong anyway.

FAQ

How much was stolen in the Binance hack?

About US$6.3 billion in bitcoin and other crypto assets was taken on October 29, 2026, which the Associated Press described as the biggest crypto heist in history. Binance says it has replenished most of the affected assets and that roughly US$2.85 billion was frozen or intercepted, subject to reconciliation.

Who is behind the Binance hack?

The FBI has attributed the theft to North Korean actors it calls TraderTraitor, the same group it linked to the 2025 Bybit hack. That attribution is the FBI’s assessment rather than a finding by a court. Binance itself has not publicly named who it believes is responsible.

Will crypto exchange users get their money back after a hack?

Binance has promised its users won’t bear the loss, but that is its own business decision. In general, recovery after an exchange hack depends on the platform’s terms of use, where it is regulated, whether it was negligent, and whether it has the money to pay. Smaller platforms may not be able to cover losses.

---

This article reflects my personal views and is for general information only. It isn’t legal advice and doesn’t represent the views of any organization I am affiliated to. If you need advice on your specific situation, talk to a qualified lawyer in your jurisdiction.