🔍 Read the full analysis: The $6.3 Billion Binance Hack Began With An Interview on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says attackers used a fake job interview and malicious coding assignment to compromise an engineer’s work computer, then moved through internal systems before abusing a wallet-signing service on Oct. 29. The exchange reported about $6.34 billion in affected assets and said roughly $2.85 billion was frozen or intercepted; the FBI attributed the activity to North Korea, which denies involvement.
Binance says attackers who took about $6.34 billion in digital assets from its hot wallets on Oct. 29 gained access through a fake job interview and a malicious coding assignment sent to one of its software engineers. In a detailed report published Nov. 3, the exchange described how the attackers moved through employee computers and used a deployment permission token to reach its internal wallet-signing service.
According to Binance, an engineer identified as Engineer B was contacted in September on a legitimate job-hunting platform by someone posing as a project director. The engineer took part in a video interview with a person presented as human resources staff, followed by a chat with someone claiming to be the CEO of a company Binance says did not exist. The engineer was then asked to download a coding assignment onto a work computer. Binance says the repository contained malicious code that ran during setup.
Binance describes a wider sequence extending back to June. It says a Wallet DevOps engineer, identified as Engineer A, had earlier downloaded a tampered Homebrew installation while trying to install an unnamed popular AI coding tool. Binance says its security team detected the problem, replaced the device and rotated credentials, but the incident may have helped the attackers identify the engineer’s role and wallet-team colleagues. The exchange does not say that this June activity was part of the same campaign with certainty.
Binance says the attackers later used an internal AI tool on Oct. 20 to gain control of Engineer A’s machine and another engineer’s computer. They found a container deployment permission token on Engineer A’s device. On Oct. 29, the attacker used credentials attributed to Engineer A, deployed a container and ran a script that reached the wallet-signing service. Binance says funds began moving from hot wallets at about 20:05 UTC, outside the normal withdrawal process. It reported about $2.85 billion frozen or intercepted and said it had replenished 98% of affected tokens by Oct. 31 using its own funds.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
Recruitment Became an Entry Point
The account shows how a routine hiring interaction can become a route into corporate systems. The attacker did not rely only on a generic phishing message: Binance says the approach involved a job platform, live video, personal-looking social media material and a coding task tailored to the target’s work. That matters to employers because hiring processes can expose staff to files and software from people whose identity has not been verified.
The reported use of a deployment permission token also points to the potential consequences of compromising an employee device with access to operational systems. Binance says the attackers reached its signer and caused it to authorize transactions, rather than reporting that wallet private keys were stolen. The distinction matters: a signing system can be abused through access and permissions even when key material itself is not known to have been taken.
For job seekers, the episode is a warning about running unfamiliar assignments on a work computer. For companies, it raises questions about how developer tools are installed, where deployment credentials are stored, and what controls separate employee devices from systems that authorize high-value transactions. Binance’s report is the exchange’s account of the incident; it does not independently establish every step or explain all of the safeguards that were in place.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky
As an affiliate, we earn on qualifying purchases.
From Laptop Alert to Attack Timeline
Binance’s first public comments on Oct. 30 identified a potentially compromised DevOps engineer’s laptop and said it had found no evidence that wallet private keys were leaked. Analysts cited in the source account interpreted the activity as attackers getting Binance’s own signing system to approve transactions, rather than taking the keys and signing elsewhere. The Nov. 3 report adds the alleged recruitment route and describes how access moved between employee machines.
The exchange calls the incident a “sophisticated, multi-stage campaign” and says it was not a single isolated breach or simple phishing incident. Its chronology places the initial suspicious software installation in June, the job-platform approach in September, a further move between computers on Oct. 20, and the wallet activity on Oct. 29. Binance’s report names the affected staff only as Engineers A, B and C.
The FBI, as cited by Binance, attributed the activity to North Korea and referred to it as “TraderTraitor.” North Korea denies involvement. The source material also says Binance linked to a security write-up about a fake Homebrew site distributed through a search advertisement, but Binance did not say that the exact campaign described in that write-up affected its employee.
Open Questions in Binance’s Account
Binance has not explained how the attackers used its internal AI tool, what the tool could access, or what controls allowed it to reach Engineer A’s and Engineer C’s machines. The exchange also has not named the AI coding tool involved in the June installation or said whether that episode was definitively connected to the later intrusion.
The report does not provide a time zone for the 17:15–19:56 period it gives for activity on Engineer C’s computer, although it lists other times in UTC. It also does not set out the full transaction-by-transaction breakdown behind the $6.34 billion affected figure, or identify how much of the reported frozen or intercepted amount was recovered through each measure. The stated 98% replenishment figure is Binance’s report of its own actions as of Oct. 31.
Attribution remains disputed: Binance cites the FBI’s assessment that North Korea was responsible, while North Korea denies it. The report does not supply independent evidence that resolves that dispute. Binance’s account is the primary source for the technical sequence described here, and further details may emerge from investigators or later company disclosures.
Investigation and Security Changes
Binance’s report does not provide a timetable for a final investigation or announce specific changes to its hiring, endpoint or deployment-token policies. Further updates from the exchange could clarify how the internal AI tool was accessed, how the token was protected and what safeguards are being added to prevent a compromised workstation from reaching wallet-signing systems.
Investigators’ findings may also add detail to the attribution and the movement of funds. Until then, the confirmed public account remains Binance’s description of the sequence, its reported asset and recovery figures, and the FBI attribution cited by the company. The key next development is whether Binance or investigators publish evidence that fills in the access path and the controls that failed or were bypassed.
Key Questions
How did the Binance attack reportedly begin?
Binance says an engineer was approached on a legitimate job-hunting platform by someone posing as a project director, then asked to download a malicious coding assignment onto a work computer.
How much was affected, and how much was frozen or intercepted?
Binance reported about $6.34 billion in affected digital assets and about $2.85 billion frozen or intercepted. It said it had replenished 98% of the affected tokens by Oct. 31 using its own funds.
Were Binance wallet private keys stolen?
Binance said on Oct. 30 that it had found no evidence of a wallet private-key leak. Its later account says the attacker reached an internal signing service and used it to authorize transactions outside the normal withdrawal process.
Who does the FBI say was responsible?
Binance says the FBI attributed the activity to North Korea and called it “TraderTraitor.” North Korea denies involvement, and the public material cited here does not independently resolve the attribution.
What remains unknown about the internal AI tool?
Binance has not explained how the attackers used the tool, what access it had, or how it enabled control of employee computers. The company also has not named the AI coding tool involved in the separate June installation episode.
Source: ThorstenMeyerAI.com
