🔍 Read the full analysis: How Binance’s $6.3 Billion Hack Began With A Fake Job Interview on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance said a software engineer was targeted through a fake job interview and malicious coding assignment before an attacker used stolen access to reach the exchange’s wallet-signing system. The company reported about $6.34 billion in digital assets were affected, with about $2.85 billion frozen or intercepted and 98% of affected tokens replenished by Oct. 31. Binance’s account does not explain how an internal AI tool was used in the attack.
Binance said a fake job interview helped attackers gain access to an employee’s work computer before they used internal credentials and a deployment token to reach the exchange’s wallet-signing service. In a report published Nov. 3, the company said about $6.34 billion in digital assets were affected during the Oct. 29 incident, making the disclosure a detailed account of how the breach developed over several months.
Binance’s report says a software engineer, identified as Engineer B, was contacted in September through a legitimate job-hunting platform by someone posing as a project director. After two rounds of contact, including a video interview and a conversation on a social messaging app, the employee was told to download a coding assignment to a Binance work computer. Binance says the assignment contained a malicious code repository. The company describes the malware as new and says endpoint security tools did not detect it at the time.
The report traces other activity to June, when Engineer A, a wallet DevOps employee, installed a popular AI coding tool through a tampered Homebrew installation. Binance says its security team detected that incident, replaced the device and rotated credentials. On Oct. 20, the attacker used an internal AI tool to gain control of Engineer A’s machine and a third employee’s computer, according to the report. The attacker then found a container deployment permission token on Engineer A’s machine.
On Oct. 29, Binance says the attacker used stolen credentials to deploy a container and run a malicious script, reaching the exchange’s wallet-signing service outside the normal withdrawal process. The report puts the operation on Engineer C’s computer between 17:15 and 19:56, without specifying a time zone for those times. Binance says funds began leaving through the signing service from 20:05 UTC. It reported that about $2.85 billion was frozen or intercepted and that 98% of the affected tokens had been replenished from its own funds by Oct. 31.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
A Hiring Process Became an Attack Route
The account shows how a routine recruitment exercise can expose a company to risks beyond a single employee’s device. In Binance’s description, the attacker used a credible interview process to persuade an engineer to run code on a work computer, then combined access across employees with a deployment token to reach a sensitive signing service. The report describes an attack that unfolded over months, rather than one isolated phishing message.
The incident also highlights the difference between stealing private keys and abusing access to a system that signs transactions. Binance previously said it had found no evidence of a wallet private-key leak; its new account says the attacker reached the signing service and caused it to authorize transfers outside the usual withdrawal process. That distinction matters because it points to controls around employee devices, credentials, deployment permissions and transaction-signing workflows—not only the storage of keys.
For employers, the reported sequence is a reason to treat hiring tasks and developer tools as potential security risks. For job seekers, downloading an unfamiliar assignment onto an employer-managed device can expose workplace systems. The report does not establish that the AI tool itself caused the breach, but its use in the chain makes the tool’s access and oversight relevant questions.
Popular right now
iRobot Roomba 105 Robot Vacuum with LiDAR Navigation
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Hazelnut Taupe
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
As an affiliate, we earn on qualifying purchases.
From June Install to October Transfers
Binance’s chronology starts in June 2026, with the tampered Homebrew installation on Engineer A’s device. Binance says it responded by replacing the computer and rotating credentials, but the attacker had learned the employee’s role and connections to the wallet team. The company links to a SANS Internet Storm Center report about a fake Homebrew site promoted through a search advertisement; Binance does not say that the exact campaign described there targeted its employee.
The next reported step was the fake recruitment approach in September. Binance says the first contact came through a legitimate job platform and that the interview process included a live video call with a person posing as HR. A second round moved to a chat app, where a person claiming to be the CEO of a company that did not exist presented the coding task.
On Oct. 30, Binance had identified a compromised DevOps engineer’s laptop and said there was no evidence of wallet private keys being leaked. The Nov. 3 report adds the alleged entry route, cross-device access and use of a deployment token. Binance calls the activity a “sophisticated, multi-stage campaign” and says it was not a single isolated breach or simple phishing incident.
Key Details Remain Unreported
Binance has not explained how the internal AI tool was used to gain control of Engineer A’s and Engineer C’s machines, or what safeguards governed that tool’s access. The company also did not name the AI coding product installed in June, identify the employees publicly, or provide technical details sufficient to independently assess the attack sequence.
The report’s account is Binance’s own description of the incident. The source material says the FBI attributed the activity to North Korea under the name TraderTraitor and that North Korea denied the allegation; it does not provide the FBI’s underlying evidence or a response from the agency. Binance also gives no time zone for the 17:15–19:56 period it lists for activity on Engineer C’s computer. The precise breakdown of affected assets and the status of any remaining funds are not detailed in the account provided.
Further Forensic Details Are Needed
The next questions are whether Binance will publish more technical findings about the malware, the internal AI tool and the permissions that allowed a deployment token to reach the signing service. Additional detail could clarify how the company responded after the June installation and what changes it made to employee-device security, hiring procedures and deployment access.
Readers should also look for independently attributable findings from law enforcement or other investigators, alongside any further updates from Binance on asset recovery and the investigation. The report gives a status point through Oct. 31—including the company’s statement that 98% of affected tokens had been replenished—but does not set out a timetable for further disclosures.
Key Questions
How did the reported Binance attack begin?
Binance says a software engineer was approached through a legitimate job-hunting platform, interviewed by people posing as company staff, and asked to download a malicious coding assignment onto a work computer.
How much in digital assets was affected?
Binance reported that about $6.34 billion in digital assets were affected. It said about $2.85 billion was frozen or intercepted and that 98% of affected tokens had been replenished by Oct. 31.
Were wallet private keys stolen?
Binance previously said it had found no evidence of a wallet private-key leak. Its later report says the attacker reached the wallet-signing service and used it to authorize transfers outside the normal withdrawal process.
What role did an AI tool play?
Binance says an attacker used an internal AI tool on Oct. 20 to gain control of two employees’ machines. The report does not name the tool or explain how it was used, and it does not say that AI itself caused the breach.
Who does Binance say was responsible?
Binance cites the FBI as attributing the activity to North Korea and using the name TraderTraitor. North Korea denies involvement; the report does not provide the FBI’s underlying evidence.
Source: ThorstenMeyerAI.com
