Binance’s $6.3 Billion Hack Began With a Fake Job Interview: What the Post-Mortem Says, and How to Spot a Fake Recruiter

By Thorsten Meyer | November 4, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

In September, a Binance software engineer got a message on a job platform. A “Project Director” had a role for him. There was a friendly video interview with HR, then a chat with the “CEO”, then a small coding assignment to download. He ran it on his work computer.

Weeks later, on 29 October, about $6.34 billion in digital assets left Binance’s hot wallets in one evening.

That is the story Binance told on 3 November in its first detailed report on the 29 October hack. When we rebuilt that evening minute by minute, Binance had only said a “compromised DevOps engineer’s laptop” may be involved. Now we know how that laptop story started, how the attacker moved, and that an internal AI tool was part of the path. Here is what the report says, what it leaves out, and what any company that hires engineers should change.

Key takeaways

• The door was a job interview. Binance says a software engineer was approached on “a legitimate job-hunting platform” in September, interviewed twice by fake staff, and told to download an “assignment” repository onto his work computer. Malicious code ran during setup.
• The malware was new. “The 0-day malware was not detected by the endpoint security protection tools at the time,” Binance writes. It swapped a normal developer tool for a malicious copy and wiped its traces.
• AI tools show up twice. In June, a wallet DevOps engineer installed “a popular AI coding tool”, one that Binance did not name, through a tampered Homebrew installation. On 20 October, the attacker “used an internal AI tool” to take over that engineer’s machine and a third engineer’s. Binance does not say how.
• A token did the rest. On the DevOps engineer’s computer, the attacker found “a container deployment permission token”. On 29 October, they used it to deploy a container, run a script and reach Binance’s wallet signing service.
• The numbers, per Binance: about $6.34 billion impacted, about $2.85 billion frozen or intercepted, and 98 percent of the affected tokens replenished by 31 October from Binance’s own funds.
• Who: The FBI says North Korea did it and calls the activity “TraderTraitor”. North Korea denies it. Binance cites the FBI.
• For companies: Hiring is now an attack surface. Never let a “test task” run on a work device, and never leave deployment tokens on a laptop.
• For job seekers: A real employer will not make you run its code on your current employer’s computer.

Products Worth Considering

Amazon Kindle Paperwhite Signature Edition, 32GB (2024), Metallic Black

AmazonView Latest Price

Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black

AmazonView Latest Price

Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What is new since our first report

On 30 October, Binance named one laptop and found “no evidence of any wallet private key leak”. The analysts we quoted then read the evidence the same way: the attacker did not steal keys, they made Binance’s own signing system sign.

The 3 November report confirms that reading and adds the part that was missing: how someone outside got far enough inside to ask the signer for anything. Binance calls it “a sophisticated, multi-stage campaign” and adds: “It was not a single isolated breach or a simple phishing incident.”

It also changes the time frame. In The Guard Dog With No Safe Word we looked at the roughly 20 minutes in which most of the money left. The report shows those 20 minutes were the end of the attack, not the start. The attacker had been inside since September.

The campaign, step by step

All of this comes from Binance’s report. Binance does not name the employees; it calls them Engineer A, B and C.

• June 2026, a poisoned install. “Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool.” Homebrew is a common way to install software on a Mac. Binance’s security team caught it, replaced the device and rotated credentials. But, Binance says, Engineer A’s role and his wallet-team colleagues were now known to the attacker. Binance links to a SANS Internet Storm Center write-up of a fake Homebrew site served through a search ad; it does not say that exact campaign hit Engineer A.
• September 2026, the interview. “Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director.” His profile mentioned his work at Binance.
• 20 October 2026, the jump. From Engineer B’s machine, the attacker “used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C”. On Engineer A’s computer they found the container deployment token.
• 29 October, 17:15 to 19:56. The attacker “logged onto Software Engineer C’s computer”, “used the credentials stolen from Wallet DevOps Engineer A”, “deployed a container, and triggered a malicious script to launch the attack”. Binance gives no time zone here; its other times are UTC.
• 29 October, from 20:05 UTC. Funds leave through the internal wallet signing service, “outside the normal withdrawal process”. On Ethereum, the attacker then used the signing service to hand part of a hot wallet to its own program.

Inside the fake interview

This was not a crude email. Binance describes two rounds.

In the first, a fake HR person met the engineer on a live video call. To build trust, they shared a social media account full of personal photos and videos. Binance’s verdict: “This was more advanced and deceptive than previously seen social engineering approaches.”

The second round moved to “a popular social chat app”, with someone presenting as the CEO of a company that does not exist. That is where the task came: “Engineer B was instructed to download an “assignment” containing a malicious code repository onto his work computer.”

What the code did is the part that should worry every engineering team. It did not drop an obvious virus. According to Binance, it replaced a component of a legitimate developer tool, a Python version manager installed through Homebrew, with a malicious version, then opened a channel to the attacker’s server. To the engineer, his tools still worked. The malware was new, so the security software did not know it. And “the attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.”

Think of it like a new key-cutting machine in your office that also cuts a copy for a stranger every time. It still cuts your keys perfectly.

The AI angle: what we know and what we don’t

Two of the five steps involve AI tools. It is easy to over-read that, so here is exactly what Binance says.

• The lure: In June, Engineer A was looking for “a popular AI coding tool” and got a tampered installer. The tool itself was not the problem. The fake way to install it was. It is an AI coding tool that Binance did not name, and we do not guess which one.
• The springboard: On 20 October, the attacker “used an internal AI tool to gain control” over two more engineers. Binance did not name that tool either. Elsewhere the report speaks of “compromised internal AI tooling” and “use of an internal AI tool as a springboard”. Binance does not say whether the attacker abused the tool’s permissions, its integrations or its users’ trust. Its fix list includes “Rebuilt the affected internal AI tool and access controls” and “AI-based behavioural anomaly detection”.

My reading, not confirmed: internal AI assistants are often wired into chat, code and tickets with broad access, and colleagues trust what they say. That makes them a good relay for an attacker who is already on one machine. Until Binance publishes more, treat this as a warning about access, not a verdict on AI.

Why stopping withdrawals didn’t stop the theft

Binance suspended withdrawals that evening. It did not end the theft, because the attacker’s permission on Ethereum lived on the blockchain, outside Binance’s own systems. We explained that EIP-7702 permission in our first report.

The new detail: the hot wallet used Multi-Party Computation, MPC, where several parties jointly produce each signature and no single full key exists. That is normally a strength. Here, Binance writes, “there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations”. The team had to build a special revocation procedure. The delegation was cleared at 00:10 UTC on 30 October.

Who did it?

On 31 October, the FBI said North Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026”, and that it “refers to this specific North Korean malicious cyber activity as ‘TraderTraitor.’” The FBI published wallet addresses and asked exchanges and other services to block them. It has not released its full forensic findings.

North Korea denies it. Kim Yo Jong, sister of leader Kim Jong Un, called the accusation “absurd rhetoric and nothing new”, according to the state agency KCNA as reported by CoinDesk. The analytics firm Elliptic said its own analysis “supports the FBI’s attribution”.

Binance’s report cites the FBI and adds that “throughout 2026, Binance’s security team detected and prevented 57 suspected North Korea-linked cyber threat cases”, from fake interviews to trojanized developer tools and fake video-call apps. Fifty-seven were stopped. This one was not.

Not the first fake recruiter

The method is old. Each case below comes from an authority or the victim company.

• 2022: The FBI, CISA and the U.S. Treasury warned that TraderTraitor messages “often mimic a recruitment effort and offer high-paying jobs” and target staff “often working in system administration or software development/IT operations (DevOps)”.
• 2024, DMM Bitcoin: The FBI, the U.S. Defense Cyber Crime Center and Japan’s National Police Agency attributed a theft of about 48.2 billion yen (about $308 million) to TraderTraitor. According to the FBI’s account, as reported by Cointelegraph, it began with a fake LinkedIn recruiter and a “pre-employment test” on GitHub sent to an employee of the wallet software company Ginco.
• 2024, FBI warning: “Avoid taking pre-employment tests or executing code on company owned laptops or devices.”
• 2025, Bybit: The FBI attributed the $1.5 billion theft to North Korea. Safe{Wallet}, whose software Bybit used, traced it to a compromised machine of one of its developers.

Security researchers at Palo Alto Networks’ Unit 42 named a related fake-interview campaign “Contagious Interview” in 2023. Binance’s case resembles it, but Binance does not link the two.

What this means for companies

The lesson is not “train people better”. The engineer did what thousands of developers do every week: take an interview and a coding test. The fix is to make that safe.

• Test tasks never run on work devices. Write it into policy and say it out loud. The FBI’s advice: if code must be run, use a virtual machine on a device that is not connected to the company.
• No standing tokens on laptops. A deployment token that sat on an engineer’s computer turned a laptop compromise into a production compromise. Use short-lived credentials issued per task, bound to hardware keys, with a second person for anything that touches wallets or payments.
• Separate the signer from everything else. Wallet signing should only accept requests that pass its own policy: allowlists, value limits, and a separate approval path for unusual requests such as code delegations. Keep hot wallets small and cold storage away from any machine a developer uses.
• Treat internal AI tools like admin tools. Give them the least access they need, log what they do, and alert on unusual actions. If your assistant can reach code, chat and tickets, it can be a relay.
• Install software only from verified sources. No search ads, no copy-paste install commands from unknown pages. Pin and check package sources on engineering machines.
• Verify recruiters who contact your staff. Make it easy for employees to report recruitment approaches, and expect attackers to read their profiles, which on this evidence name their employer and role.
• Practice revocation. If your wallets use MPC, make sure you can revoke a delegation in minutes, not hours, and rehearse it.

What this means for users and job seekers

If you are looking for a job, especially in tech or crypto:

• Never run an employer’s code on a work computer, and preferably not on your personal one either. A real company can give you an online sandbox or a take-home task that runs in your browser.
• Check the company exists. Look for a registered company, a real website with history and real employees you can reach through the company’s own channels, not through the recruiter.
• Watch for the switch. A move from the job platform to a chat app, an urgent deadline and an unusually high salary are the classic signs the FBI lists.
• Be suspicious of polished social proof. In this case, the fake HR person showed a social media account full of personal photos. That proves nothing.
• Never install “special” video-call software or run a script to “fix” your camera or microphone.

If you have money on Binance: Binance says it “will absorb the financial impact of the stolen funds, not our users”, and that it replenished 98 percent of the affected tokens by 31 October. Withdrawals started reopening in phases on 1 November, according to Binance’s posts reported by CBS News. That is Binance’s statement, and it is not investment advice. Expect scams posing as refunds or Binance support.

Honest limits

• One source for the chain. Every step of the attack chain comes from Binance’s own initial report. Binance says some technical details are withheld and an independent review is coming.
• Unknowns: the job platform, the chat app, the AI coding tool, the internal AI tool and how it was abused. We do not guess.
• The numbers are Binance’s. Totals, frozen amounts and the replenishment share are its figures, subject to reconciliation.
• Attribution: The FBI attributes the attack to North Korea; North Korea denies it; the FBI has not published its evidence.

We will update this story when the independent review is published.

Sources

• Binance: 29 October 2026 Binance Security Incident: Initial Findings and Response Update, Binance Blog, 3 Nov 2026
• FBI: North Korea Responsible for $6 Billion+ Binance Attack, 31 Oct 2026
• CoinDesk: Binance’s $6.3 billion hack began with a fake job interview, exchange says, 3 Nov 2026 (Binance media briefing)
• BleepingComputer: Binance says fake job interview led to $6.3 billion crypto heist, 3 Nov 2026
• CoinDesk: North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor, 3 Nov 2026
• CBS News: Binance resumes withdrawals for some major cryptocurrencies after $6 billion heist, 2 Nov 2026
• SANS Internet Storm Center: Malicious Ad for Homebrew Leads to MacSync Stealer, 1 May 2026
• FBI: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, PSA, 3 Sep 2024
• CISA, FBI, U.S. Treasury: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, 18 Apr 2022
• FBI, DC3, NPA: Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million from Bitcoin.DMM.com, 23 Dec 2024; Japan’s National Police Agency: notice and English alert; Cointelegraph: FBI, Japan expose North Korea’s $305M DMM exchange hack details, 24 Dec 2024
• FBI: North Korea Responsible for $1.5 Billion Bybit Hack, 26 Feb 2025; Safe{Wallet}: statement on X, 26 Feb 2025
• Palo Alto Networks Unit 42: Hacking Employers and Seeking Employment, 21 Nov 2023