🔍 Read the full analysis: How To Vet AI Recruiters After Binance’s $6.3 Billion Hack on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance’s Nov. 3 report says a software engineer was targeted through a fake recruiting process, and that attackers later used an internal AI tool and a deployment token in the chain leading to the Oct. 29 wallet breach. The company reported about $6.34 billion in affected assets, about $2.85 billion frozen or intercepted, and 98% of affected tokens replenished by Oct. 31. Some technical details remain undisclosed, including how the internal AI tool was used.
According to Binance, a software engineer whose profile identified his employer was contacted on a legitimate job-hunting platform in September by someone posing as a project director. The engineer took part in two rounds of interviews, including a video call with a person presenting as HR and a later chat with someone claiming to be a company CEO. Binance says the engineer was then asked to download a coding assignment onto his work computer. The company does not name the employee or the supposed employer.
Binance says malicious code ran during setup and that the malware was not detected by endpoint security tools at the time. Its report describes a separate earlier incident in June involving a Wallet DevOps engineer who downloaded a tampered Homebrew installation while seeking a popular AI coding tool. Binance says it detected that incident, replaced the device and rotated credentials. It does not identify the AI tool or say the June installation was part of the exact same malware campaign.
On Oct. 20, the attacker used an internal AI tool to gain control of the DevOps engineer’s computer and another software engineer’s machine, Binance says. The attacker found a container deployment permission token on the DevOps employee’s device. On Oct. 29, Binance says, the attacker used stolen credentials to deploy a container and run a script that reached its wallet signing service outside the normal withdrawal process. The report places activity between 17:15 and 19:56, without specifying a time zone for that interval; it says funds began leaving from 20:05 UTC.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
Why Hiring Became an Entry Point
The account makes recruitment a documented part of the attack chain, rather than a routine HR concern. A credible-looking interview and coding exercise gave an attacker a route to an employee’s work machine, according to Binance. For employers, that means hiring procedures and employee device rules can affect the security of systems well beyond the recruiting team.
The report also illustrates the potential consequences of credentials and deployment permissions being accessible from employee devices. Binance says the attacker used a token to reach an internal signing service; the available account does not say that wallet private keys were stolen. The distinction matters: Binance’s earlier statement said it had found no evidence of a private-key leak, while the new report describes the attacker getting the system to sign transactions.
Binance reported about $2.85 billion frozen or intercepted and said it had replenished 98% of affected tokens by Oct. 31 using its own funds. Those figures describe the company’s reported response; they do not establish the final disposition of every asset or independently verify the full impact.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 512GB SSD, and 12MP Center Stage camera
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Device Alert to Wallet Breach
Binance first said on Oct. 30 that a compromised DevOps engineer’s laptop may have been involved and that it had found no evidence of a wallet private-key leak. Its Nov. 3 report expands the timeline: it describes a June device incident, the September recruiting approach, access on Oct. 20 and the wallet activity on Oct. 29. Binance characterizes the incident as a multi-stage campaign, not a single isolated breach.
The company attributes the attack to North Korea, citing the FBI, which calls the activity “TraderTraitor.” North Korea denies the allegation. The attribution is not independently established by the details supplied in Binance’s account.
The source account’s practical advice is that candidates should not run a prospective employer’s code on a current employer’s computer. For companies, the described chain also raises questions about how test assignments are reviewed, how employee devices are isolated, and where deployment credentials are stored. These are implications of Binance’s account, not a complete set of confirmed causes or remedies.
Technical Gaps in Binance’s Account
Binance does not explain how the attacker used its internal AI tool to take control of two employees’ machines, what safeguards that tool had, or whether the AI system itself was compromised. It has not named the coding tool involved in the June incident or the job platform and chat app used in the fake interview.
The report also does not provide a time zone for the 17:15–19:56 activity on Oct. 29, nor does the supplied account detail every affected asset, the final amount recovered, or the technical controls that permitted the deployment token to reach the signing service. Binance’s claims about the attack and its response have not been independently verified in the source material. The FBI attribution is cited by Binance, while North Korea denies involvement.
Further Findings and Hiring Safeguards
Binance may provide further technical details as its investigation proceeds; the report supplied here does not set a date for another update. Readers should watch for clarification on the AI tool’s role, how the deployment token was obtained and used, and the final accounting of affected and recovered assets.
Companies reviewing the incident can examine whether candidates’ code is ever run on employee work devices, whether deployment permissions are held on laptops, and how access is revoked after a device alert. Job seekers can verify recruiters through independently sourced company channels and avoid running interview assignments on a current employer’s computer. Those are precautionary steps, not findings that Binance has confirmed as a complete fix.
Key Questions
How did the fake recruiting approach work?
Binance says an employee was contacted on a legitimate job platform, spoke with people posing as HR and a company CEO, and was asked to download a coding assignment onto his work computer. The company says malicious code ran during setup.
What role did an AI tool play in the attack?
Binance says an internal AI tool was used on Oct. 20 to gain control of two engineers’ machines. It has not explained how the tool was used or named the popular AI coding tool involved in a separate June device incident.
Did Binance say wallet private keys were stolen?
No. Binance previously said it found no evidence of a wallet private-key leak. Its later account says attackers reached the wallet signing service and used it outside the normal withdrawal process.
How much of the reported loss was frozen or replenished?
Binance reported about $2.85 billion frozen or intercepted and said it had replenished 98% of affected tokens by Oct. 31 using company funds. The supplied account does not give a final accounting of every asset.
Source: ThorstenMeyerAI.com
