A Fake Recruiter, An AI Job Pitch, And Binance’s $6.3 Billion Hack

🔍 Read the full analysis: A Fake Recruiter, An AI Job Pitch, And Binance’s $6.3 Billion Hack on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Binance says attackers used a fake job interview to persuade one of its software engineers to run a malicious coding assignment on a work computer, a route that ultimately helped them reach the exchange’s wallet-signing system during the October 29 attack. In a report published November 3, Binance put the digital assets affected at about $6.34 billion and said the incident involved a campaign that began weeks before the funds moved.

According to Binance’s account, an engineer identified as Engineer B was contacted through a legitimate job-hunting platform in September by someone posing as a project director. The engineer, whose profile mentioned Binance, took part in a video interview with a person posing as HR and later spoke with someone claiming to be the CEO of a company Binance says did not exist. The engineer was then asked to download a coding assignment containing a malicious repository onto a work computer. Binance says new malware ran during setup and was not detected by endpoint security tools at the time.

Binance says the attack’s path also involved two other employees, identified as Engineers A and C. In June, Engineer A had installed a popular AI coding tool using a tampered Homebrew installation, according to the report. Binance says its security team detected that earlier incident, replaced the device and rotated credentials. It does not name the AI tool or say that the June installation was the same campaign as the later intrusion.

On October 20, the attacker used an internal AI tool to gain control of Engineer A’s computer and Engineer C’s, Binance says, without describing how the tool was used. The attacker found a container-deployment permission token on Engineer A’s machine. On October 29, Binance says the attacker used stolen credentials, deployed a container and ran a malicious script that reached the wallet-signing service. The exchange says funds began leaving through that service outside the normal withdrawal process from 20:05 UTC.

How the Attack Reached Wallet Signing

The report describes a security failure that began with recruitment rather than a conventional intrusion attempt. An apparently ordinary job process gave the attacker a way to get code onto an employee’s work device. From there, Binance says, access to internal systems and a deployment token helped the attacker reach a service authorized to sign transactions.

That distinction matters because Binance previously said there was no evidence that wallet private keys had been leaked. Its October 30 account focused on a compromised DevOps engineer’s laptop. The new report supports the interpretation that the attacker used Binance’s own signing infrastructure to authorize transactions, rather than simply taking keys and signing elsewhere. The exchange says the activity was outside its normal withdrawal process.

For employers, the account highlights how hiring procedures and developer permissions can intersect with operational security. A coding test that is run on a company device can expose that device if the code is malicious; a deployment token stored on a laptop can then create further risk. The report does not establish that every link in the attack would have been prevented by a single control, but it shows why firms need to treat recruiting contacts, software installation and access credentials as connected security concerns.

Products Worth Considering

Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours

AmazonView Latest Price

Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, Space Black

AmazonView Latest Price

Apple Watch SE 3 GPS Smartwatch, 40mm

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From June Installation to October Theft

Binance’s timeline places the apparent campaign well before the roughly 20-minute period in which most of the funds left. The exchange says a tampered Homebrew installation affected Engineer A in June. In September, Engineer B was approached through a job platform. On October 20, the attacker gained control of Engineer A’s and Engineer C’s machines using an internal AI tool, according to Binance. The funds moved on October 29.

Binance’s October 30 statement had identified a compromised DevOps engineer’s laptop as a possible factor and said it had found no evidence that wallet private keys were exposed. The November 3 report adds the alleged recruitment route, the earlier software-installation episode and the use of a deployment token. Binance calls the incident a “sophisticated, multi-stage campaign,” rather than a single isolated breach or simple phishing incident.

The report attributes the North Korean link to the FBI, which calls the activity “TraderTraitor.” North Korea denies responsibility. That attribution is separate from Binance’s account of the technical sequence and should be understood as an official allegation, not an uncontested finding.

What Binance Has Not Explained

Binance’s report does not explain how the internal AI tool was used to gain control of the two engineers’ machines, or identify the tool. It also does not provide technical details about the malware beyond describing it as previously undetected by the endpoint tools in place at the time. The exchange’s report is its account of the incident; the supplied material does not include an independent forensic assessment of each step.

The report does not name the job platform, the chat application, the purported company or the employees. Binance also does not specify the time zone for the 17:15–19:56 period it gives for activity on October 29; it separately places fund movements from 20:05 UTC. The material does not establish whether the June tampered installation and September recruiting approach were operated by the same people, although Binance links both to the broader account.

Binance says about $2.85 billion was frozen or intercepted and 98% of affected tokens had been replenished by October 31 using its own funds. The report does not clarify in the supplied material how much of the affected value was ultimately recovered from the attacker, or provide a token-by-token breakdown. The FBI’s attribution to North Korea is disputed by North Korea.

Further Forensic Details to Watch

Binance’s November 3 report is its first detailed public account of the attack, but it leaves technical and operational questions open. Further updates from the exchange could clarify how the attacker used the internal AI tool, what controls allowed the deployment token to be accessed, and what changes Binance has made to its hiring, endpoint-security and wallet-signing procedures.

Readers should also look for any additional independent technical analysis and for updates on the disposition of the affected assets. The figures in Binance’s report describe the impact, frozen or intercepted funds and replenishment as of October 31; they do not by themselves settle how much was permanently lost or recovered. The FBI attribution remains an allegation that North Korea denies.

Key Questions

How did the attackers reportedly get access to Binance?

Binance says an engineer was approached through a job platform, interviewed by people using false identities and asked to run a coding assignment on a work computer. The exchange says malicious code in the assignment helped the attackers gain a foothold.

What role did an AI tool play?

Binance says the attacker used an internal AI tool on October 20 to gain control of two employees’ computers. The exchange did not name the tool or explain how it was used. It also says an engineer had installed a popular AI coding tool through a tampered Homebrew installation in June; the report does not identify that tool.

Were Binance’s wallet private keys stolen?

Binance said on October 30 that it had found no evidence of a wallet private-key leak. Its later report says the attacker reached the internal signing service and used it to move funds outside the normal withdrawal process.

How much was affected, and what was recovered or replaced?

Binance reported about $6.34 billion in affected digital assets and said about $2.85 billion was frozen or intercepted. It also said it had replenished 98% of the affected tokens by October 31 using its own funds. Those figures do not establish the final amount recovered from the attacker.

Who does the FBI say was responsible?

Binance cites the FBI, which attributes the activity to North Korea and calls it “TraderTraitor.” North Korea denies responsibility, and the attribution remains disputed.

Source: ThorstenMeyerAI.com