🔍 Read the full analysis: AI Job Seekers, Take Note: Binance’s Hack Began With An Interview on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers used a fake job interview and a malicious coding assignment to compromise an engineer’s work computer, then gained access to systems involved in a $6.34 billion October wallet incident. The exchange says about $2.85 billion was frozen or intercepted and 98% of affected tokens had been replenished by Oct. 31. Key details, including how an internal AI tool was used, remain undisclosed.
Binance said on Nov. 3 that attackers used a fake recruiting process to compromise an engineer’s work computer and reach systems involved in the Oct. 29 theft of digital assets. The exchange estimates about $6.34 billion in assets were affected; it says roughly $2.85 billion was frozen or intercepted and 98% of affected tokens had been replenished by Oct. 31.
According to Binance’s report, a software engineer was approached on a legitimate job-hunting platform in September by someone posing as a “Project Director.” The engineer took part in a video interview with a person presented as human-resources staff, then spoke with another person posing as the CEO of a company Binance said did not exist. The engineer was asked to download a coding assignment containing a malicious repository onto a work computer.
Binance says malicious code ran during setup. The report describes the malware as previously unseen and says endpoint security tools did not detect it at the time. It also says the malware replaced a legitimate developer tool with a malicious copy and erased traces. Binance did not identify the job platform, the fake company, the employees or the software tool involved.
The account traces activity beyond the interview. Binance says a Wallet DevOps engineer had installed a tampered Homebrew package in June while setting up an unnamed popular AI coding tool. On Oct. 20, the attacker used an internal AI tool to gain control of that engineer’s computer and another engineer’s, according to Binance. The attacker then found a container-deployment permission token on the DevOps engineer’s machine. Binance says that on Oct. 29 the attacker used credentials and a deployed container to run a script that reached the exchange’s wallet-signing service.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How Recruiting Became an Entry Point
The account shows how a hiring process can expose company systems when a candidate or employee is persuaded to run untrusted code on a work device. The incident, as Binance describes it, was not limited to a fraudulent message: the attackers built trust through interviews, obtained access to an employee’s machine and later used a deployment token to reach an internal signing service.
For employers, the reported sequence puts coding-test procedures, endpoint controls and credential storage in focus. A work laptop used to complete an outside assignment may contain access to company systems. A deployment token left on that machine can turn a compromised endpoint into a route toward sensitive infrastructure. The report does not establish that every detail of this chain would apply to other companies, but it illustrates why recruiting and developer-device security overlap.
For job seekers, the practical issue is whether an assignment asks them to run code on a device belonging to their current employer. Binance’s report says that is how the malicious repository reached the engineer’s work computer. It does not say the engineer knew the code was malicious.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Sony WH-1000XM4C (M4 2nd Gen) Wireless Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From Laptop Access to Wallet Signing
Binance’s Nov. 3 report adds detail to an earlier account. On Oct. 30, the exchange had identified a compromised DevOps engineer’s laptop as potentially involved and said it had found no evidence that wallet private keys were leaked. The new report says the attacker instead reached Binance’s own signing system, which could authorize transactions without the attacker first taking the private keys, according to the exchange.
Binance describes the activity as a multi-stage campaign that began before the roughly 20-minute period in which most of the funds moved. It says the attack culminated on Oct. 29, when a container and malicious script were used to access the signing service outside the normal withdrawal process. Binance reports that affected assets totaled about $6.34 billion and says 98% of affected tokens had been replenished from its own funds by Oct. 31.
The FBI has attributed the activity to North Korea and calls it “TraderTraitor,” according to the source report. North Korea denies the allegation. Binance cites the FBI’s assessment; the available account does not provide independent evidence establishing the attribution.
What Binance Has Not Disclosed
Binance has not explained how its internal AI tool was used to gain control of two engineers’ computers, or what access that tool provided. The exchange also has not named the AI coding product installed through the tampered Homebrew package, the job platform, the social-chat app, the fake company or the malware. The report does not say whether the June installation and September interview were carried out by the same attacker or were linked through a specific technical mechanism.
Some timing details are also incomplete: Binance gives a time range for activity on Oct. 29 but does not specify a time zone for that portion of its timeline. The report’s estimated asset impact, recovery figures and account of the intrusion are Binance’s own statements. The FBI’s North Korea attribution remains disputed by North Korea, and the source material does not offer an independent forensic assessment.
Further Forensics and Security Changes
Binance’s Nov. 3 report is its first detailed account of the incident, but the published material leaves open questions about the internal AI tool, the malware and the links between the earlier software installation and later intrusion. Further technical findings or statements from Binance, investigators or affected parties could clarify those points. No additional report or publication date is specified in the source material.
Companies reviewing the reported chain can examine how coding assignments are handled, whether outside code is run on employer devices, and where deployment credentials are stored. Those are security implications of Binance’s account, not announced changes Binance has made. The exchange says it replenished 98% of affected tokens by Oct. 31; the source material does not provide a later recovery update or detail the status of the remaining assets.
Key Questions
What does Binance say happened?
Binance says a fake recruiting process led an engineer to download a malicious coding assignment onto a work computer. Attackers later used access to employee machines and a deployment token to reach the exchange’s wallet-signing service during the Oct. 29 incident.
How much was affected, and how much was recovered?
Binance estimates that about $6.34 billion in digital assets were affected and says about $2.85 billion was frozen or intercepted. The exchange said 98% of affected tokens had been replenished from its own funds by Oct. 31.
Did attackers steal Binance’s wallet private keys?
Binance said it found no evidence of a wallet private-key leak. Its report says the attacker reached the internal signing service and used it to authorize activity outside the normal withdrawal process.
What role did AI tools play?
Binance says an unnamed popular AI coding tool was installed through a tampered Homebrew package in June, and that an internal AI tool was used on Oct. 20 to gain control of two engineers’ computers. The exchange has not described how the internal tool was used or named either product.
Who does the FBI say was responsible?
The FBI attributes the activity to North Korea and uses the name “TraderTraitor,” according to the source report. North Korea denies the allegation, and the account provided here does not independently establish responsibility.
Source: ThorstenMeyerAI.com
