🔍 Read the full analysis: Was A Fake Job Interview The Start Of Binance’s $6.3 Billion Hack? on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance’s November 3 report says an engineer was targeted through a fake job interview and ran a malicious coding assignment on a work computer. The company links that access to a wider campaign that used stolen credentials and a deployment token to reach its wallet-signing service; Binance says about $6.34 billion in digital assets was affected. The reported route and North Korea attribution remain claims by Binance and the FBI, respectively.
Binance says a fake job interview was the entry point for a months-long campaign that culminated in the theft of about $6.34 billion in digital assets from its hot wallets on October 29. In a detailed report published November 3, the cryptocurrency exchange said an engineer downloaded a malicious coding assignment to a work computer, allowing attackers to gain access that later reached Binance’s internal wallet-signing service.
According to Binance, the engineer, identified as Engineer B, was contacted in September through a legitimate job-hunting platform by someone posing as a project director. The process included a live video interview with a fake human-resources representative and a later chat with a person claiming to be a company CEO. Binance says the engineer was then asked to download a coding assignment containing a malicious repository onto a work computer.
Binance says the malware ran during setup and was not detected by endpoint security tools at the time. The report describes it as previously unseen malware that replaced a legitimate developer tool with a malicious version and removed traces of its activity. The company has not publicly named the engineers or the AI coding tool referenced elsewhere in its account.
Binance’s report also describes earlier and later stages. In June, Engineer A, a wallet DevOps engineer, installed a popular AI coding tool through a tampered Homebrew installation. Binance says its security team detected that incident, replaced the device and rotated credentials. On October 20, the attacker used an internal AI tool to gain control of Engineer A’s computer and that of Engineer C, a wallet software engineer. Binance does not explain how the internal tool was used to obtain that access.
On October 29, the attacker used credentials associated with Engineer A and a container-deployment permission token found on that engineer’s computer. Binance says the attacker deployed a container, ran a malicious script and reached the exchange’s wallet-signing service. Beginning at 20:05 UTC, funds moved through the service outside the normal withdrawal process. Binance reports that about $2.85 billion was frozen or intercepted and that it had replenished 98% of the affected tokens by October 31 using its own funds.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How Recruitment Became a Security Risk
The account matters because it describes an attack that, according to Binance, began not with a conventional breach of a wallet but with a targeted recruitment approach. A coding test can give an attacker a reason to persuade an employee to run software on a work device. If that device also holds credentials or deployment permissions, the consequences may extend well beyond the original employee’s account.
Binance says the attacker reached its signing service and used it to authorize transactions, rather than obtaining evidence of a wallet private-key leak. That distinction is important: a signing system can be abused through legitimate access paths even when private keys are not shown to have been stolen. The report does not establish that every company using internal AI tools or developer tokens faces the same exposure, but it highlights how recruitment, endpoint security and access controls can intersect.
The reported financial figures also carry different meanings. Binance says approximately $6.34 billion in assets was affected, not that this amount was necessarily the final unrecovered loss. The company says it froze or intercepted about $2.85 billion and replenished 98% of affected tokens by October 31. The report does not provide a complete breakdown of what remained unrecovered at that point.
Products Worth Considering
Garmin Venu® 3 Premium Fitness Smartwatch 45mm Black
Bowflex SelectTech 840 Adjustable Kettlebell
Philips Sonicare ProtectiveClean 5300 Rechargeable Electric Toothbrush, Black, with 3 Brush Heads
As an affiliate, we earn on qualifying purchases.
From Laptop Alert to Attack Timeline
On October 30, Binance had said a compromised DevOps engineer’s laptop may have been involved and reported no evidence that wallet private keys had leaked. The November 3 account adds the alleged recruitment approach and a longer timeline, placing the campaign’s beginnings in June and the fake interview in September. Binance describes the October 29 theft as the final stage of a multi-step operation, rather than an isolated incident lasting only the roughly 20 minutes in which most funds moved.
Binance attributes the attack to North Korea, citing the FBI, which refers to the activity as “TraderTraitor.” North Korea denies involvement. The attribution is not independently established in the information provided here. Binance says it is still investigating and does not identify the job platform, the social chat application, the nonexistent company, or the specific AI tool involved.
Gaps in Binance’s Account
Binance’s report is the primary account of how the intrusion unfolded, and the detailed sequence has not been independently verified in the source material. It does not explain how the attacker used the internal AI tool, how the deployment token was protected or exposed, or precisely how the signing service accepted the transactions. The company also does not name the AI product, job platform or chat app.
The reported asset figures do not fully resolve the financial outcome. Binance gives amounts affected and frozen or intercepted, and says it replenished 98% of affected tokens by October 31, but does not specify the remaining amount or provide a final accounting. Responsibility is also disputed: Binance cites the FBI’s attribution to North Korea, while North Korea denies it.
Investigation and Security Changes
Binance says its investigation is continuing. Further reporting from the exchange could clarify how the internal AI tool was involved, how access to the signing service was obtained, and how much of the affected assets ultimately remained unrecovered. The company has not given a timetable for a final incident report in the material provided.
For organizations, the reported chain points to practical questions about how coding assignments are handled, whether developer devices can hold deployment tokens, and how access to wallet-signing systems is restricted and monitored. Those are risk areas suggested by Binance’s account, not confirmed findings about other companies. Readers should distinguish those general security implications from the specific details Binance has disclosed about its own investigation.
Key Questions
What does Binance say started the attack?
Binance says an engineer was approached through a legitimate job-hunting platform in September, interviewed by people posing as company staff and asked to run a malicious coding assignment on a work computer.
How much was affected, and how much did Binance recover or replenish?
Binance says about $6.34 billion in digital assets was affected, about $2.85 billion was frozen or intercepted, and 98% of affected tokens had been replenished by October 31. It has not provided a final breakdown of the remaining amount in the supplied report.
Were Binance’s wallet private keys stolen?
Binance said on October 30 that it had found no evidence of a wallet private-key leak. Its later account says the attacker reached the wallet-signing service and used it to authorize transfers. The report does not describe a private-key theft.
Who does Binance say was responsible?
Binance cites the FBI’s attribution to North Korea and its use of the name “TraderTraitor.” North Korea denies involvement, and the attribution is not independently established in the source material provided.
Source: ThorstenMeyerAI.com
