🔍 Read the full analysis: Could A Job Interview Be A Path Into A Crypto Hack? on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a fake job interview and a malicious coding assignment helped attackers gain access to employee machines before the Oct. 29 wallet attack. The exchange reported about $6.34 billion in digital assets were impacted, with about $2.85 billion frozen or intercepted; it says 98% of affected tokens had been replenished by Oct. 31.
Binance said Nov. 3 that attackers used a fake job interview and a malicious coding assignment to gain access to employee computers before an Oct. 29 attack that affected about $6.34 billion in digital assets. The exchange’s account says the attackers obtained a container-deployment token and used Binance’s internal wallet-signing service; the report adds detail to the company’s earlier disclosure of a compromised engineer’s laptop.
Binance’s report describes a campaign that began in June 2026, when a Wallet DevOps engineer installed a popular AI coding tool through a tampered Homebrew installation. Binance says its security team detected that incident, replaced the device and rotated credentials. The exchange does not name the tool or say the June incident was the same operation as the later attack, but says the attackers learned the engineer’s role and that of colleagues on the wallet team.
In September, a second engineer was contacted on what Binance called a legitimate job-hunting platform by someone posing as a project director. Binance says the engineer took part in a video interview with a fake human-resources representative, followed by a chat with someone claiming to be a company CEO. The engineer was then asked to download a coding assignment containing a malicious repository onto a work computer.
According to Binance, on Oct. 20 an attacker used an internal AI tool to gain control of the first engineer’s machine and a third engineer’s computer. The report does not explain how the tool was used. The attacker found a container-deployment permission token on the DevOps engineer’s machine. On Oct. 29, Binance says, the attacker used credentials from that engineer, deployed a container and ran a malicious script that reached the wallet-signing service outside the normal withdrawal process.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How a Hiring Process Reached Wallet Controls
The account matters because the reported entry point was not a direct attack on a wallet or a conventional message asking an employee to reveal a password. It was a recruiting process that led an engineer to run code on a work device. That makes hiring-related contact and technical assessments potential security risks for organizations whose employees have access to production systems.
Binance’s description also points to the consequences of deployment credentials stored on an employee machine. The attackers reportedly used a permission token and the exchange’s own signing infrastructure rather than stealing wallet private keys. That distinction matters: access to a trusted internal system can be misused even when private keys are not reported compromised. Binance said its earlier investigation found no evidence of a wallet private-key leak.
The figures show the scale Binance attributes to the incident, while also requiring care about what they mean. The exchange reported about $6.34 billion impacted, about $2.85 billion frozen or intercepted, and said it had replenished 98% of affected tokens by Oct. 31 using its own funds. Those are Binance’s figures; the report does not establish that the full amount was permanently lost by customers.
Products Worth Considering
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 512GB SSD, and Touch ID – Blush
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
FLEXISPOT 60 × 24-Inch Electric Standing Desk, White
As an affiliate, we earn on qualifying purchases.
From Laptop Compromise to Signing Service
On Oct. 30, Binance had identified a compromised laptop and said it had found no evidence of a wallet private-key leak. The company’s Nov. 3 report expands the timeline from the roughly 20 minutes in which most funds left to a campaign it says began months earlier. Binance characterized the incident as a multi-stage campaign, not a single phishing event.
The report says that from 20:05 UTC on Oct. 29, funds moved through the internal signing service outside Binance’s ordinary withdrawal process. Binance’s account says the attacker deployed a container and triggered a script to reach that service. The report also describes a separate earlier installation incident involving a tampered Homebrew setup, but does not establish that the same malware or operator was responsible for every stage.
Binance cites the FBI’s attribution of the activity to North Korea, which the bureau calls “TraderTraitor.” North Korea denies responsibility. That attribution is distinct from Binance’s technical account of how the attack proceeded and remains an allegation by U.S. authorities, not a fact accepted by all parties.
What the Report Does Not Explain
Binance’s report leaves open how the attacker used the internal AI tool on Oct. 20, what the tool was, and what safeguards or permissions it had. The exchange also does not identify the job platform, chat app, coding repository, AI coding tool or employees involved. It has not publicly detailed the malware’s technical behavior beyond saying it substituted a legitimate developer tool with a malicious copy and removed traces.
The report does not fully explain the connection between the June tampered installation and the later campaign, or establish who operated each stage. Binance cites the FBI’s North Korea attribution, which Pyongyang denies. The published figures also do not specify the final net loss, the precise breakdown of affected assets, or how the reported replenishment translates into customer-level outcomes.
Further Forensic Details Remain Pending
Binance has published its account of the attack, but the available report leaves technical and attribution questions unresolved. Further updates from the exchange could clarify how the internal AI tool was accessed, how the deployment token was exposed and what changes have been made to hiring, endpoint and credential controls.
For employers, the account underscores the need to treat coding assignments and recruiting contacts as potential routes into work systems, and to restrict or rotate deployment permissions that reside on employee devices. Those are security implications drawn from Binance’s description, not a substitute for the investigation’s still-unreported technical findings. The FBI attribution and North Korea’s denial also remain part of the public record.
Key Questions
What does Binance say happened?
Binance says a fake recruiting process led an engineer to download a malicious coding assignment onto a work computer. The attackers later used a deployment token and reached an internal wallet-signing service during the Oct. 29 attack.
How much was affected?
Binance reported about $6.34 billion in digital assets impacted and about $2.85 billion frozen or intercepted. It said 98% of affected tokens had been replenished by Oct. 31; the report does not establish that the full impacted amount was a permanent loss.
Were wallet private keys stolen?
Binance said it found no evidence of a wallet private-key leak. Its report says the attackers reached the internal signing service, but does not describe the incident as a private-key theft.
Who does the FBI say was responsible?
Binance cited the FBI’s attribution to North Korea, using the bureau’s name “TraderTraitor” for the activity. North Korea denies responsibility.
What remains unknown about the attack?
Binance has not explained how the attacker used its internal AI tool, identified the software or platforms involved, or fully detailed the connection between the June installation incident and the later attack.
Source: ThorstenMeyerAI.com
