Binance says $6.34 billion hack began with fake job interview

What sources claim

• Binance's incident report says the $6.34 billion theft on Oct. 29 was a five-month campaign that began with a fake job interview and a poisoned developer tool, per Bitcoin Magazine.
• Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance bought on the open market.
• Binance said the attackers used a machine and an internal AI tool to reach two more wallet engineers on Oct. 20, then deployed a container with stolen credentials and launched the drain on Oct. 29 between 17:15 and 19:56 UTC.

Still unresolved

• Will Binance publish the full incident report and any further breakdown of how the frozen or intercepted $2.85 billion was recovered?
• What is the status of the remaining stolen assets not frozen or replenished, and what would on-chain data or an exchange notice show?

Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished.

Measured from the sample nearest site detection, on the same source and quote currency.