🔍 Read the full analysis: From Job Interview To Hack: Binance’s $6.3 Billion Post-Mortem on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance’s Nov. 3 post-mortem says attackers used a fake job interview and malicious coding assignment to compromise an engineer’s work computer, then used internal access to reach wallet-signing systems. Binance reported about $6.34 billion in affected digital assets, about $2.85 billion frozen or intercepted, and 98% of affected tokens replenished by Oct. 31. The company has not explained how its internal AI tool was used or provided a time zone for some events.
Binance says attackers used a fake job interview and malicious coding assignment to compromise an engineer’s work computer before reaching internal systems involved in a major Oct. 29 wallet incident. In a report published Nov. 3, the cryptocurrency exchange said about $6.34 billion in digital assets were affected; it reported that about $2.85 billion was frozen or intercepted and that 98% of the affected tokens had been replenished by Oct. 31.
According to Binance’s account, the campaign began in September 2026, when a software engineer was approached through a legitimate job-hunting platform by someone posing as a project director. The engineer had two rounds of interviews with people presenting themselves as company staff. During the second stage, the engineer was asked to download a coding assignment onto a Binance work computer. The repository contained malicious code that ran during setup, Binance said.
Binance said the malware was a zero-day that endpoint security tools did not detect at the time. The report describes it as replacing a legitimate developer tool with a malicious copy and then removing traces. The company does not identify the employees involved, referring to them as Engineers A, B and C. It says the compromised access was used on Oct. 20 to take control of the computer of a Wallet DevOps engineer and another wallet software engineer, with an internal AI tool involved in that step.
On the DevOps engineer’s machine, the attackers found a container deployment permission token, Binance said. On Oct. 29, they used credentials and access to deploy a container and run a script that reached the exchange’s wallet-signing service. Binance says the operation used that service outside the normal withdrawal process. The company has not published a full transaction-by-transaction account in the material summarized here, and some event times in its report lack a stated time zone.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How Interview Fraud Reached Wallet Signing
The report describes a chain that links recruitment fraud to access with the potential to affect systems handling digital assets. The alleged entry point was not a conventional phishing email: Binance says the attacker built credibility through video interviews and a social-media account before asking an employee to run an assignment on a work device. That makes hiring workflows and developer test tasks part of the security picture for technology firms.
The later use of a deployment token and wallet-signing infrastructure also matters beyond the initial compromise. Binance’s description suggests the attacker used internal systems to request or facilitate transactions, rather than simply taking wallet private keys. The exchange said on Oct. 30 that it had found no evidence of a wallet private-key leak; its Nov. 3 report adds details about how access reached the signing service. That distinction is important, but it does not by itself resolve all questions about the incident’s technical scope.
For customers, the immediate figures reported by Binance indicate both the scale of the affected assets and the company’s response: about $2.85 billion frozen or intercepted, and 98% of affected tokens replenished by Oct. 31. Those are figures supplied by Binance, not an independent audit in the material provided. They do not establish that all losses, costs or risks have been settled.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Bose QuietComfort Ultra Earbuds (2nd Gen), Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
From Earlier Intrusion to Oct. 29
Binance’s report expands on its initial account from Oct. 30, when it identified a compromised DevOps engineer’s laptop as potentially involved and said it had found no evidence that wallet private keys were leaked. The Nov. 3 report says the incident was not limited to the roughly 20-minute period when most of the funds moved: the broader campaign had been developing since at least September, with an earlier event in June also described.
In the June event, Binance says Engineer A installed a tampered Homebrew package while setting up a popular AI coding tool. The company said its security team detected the issue, replaced the device and rotated credentials. Binance does not say that this exact incident was part of the later attack, though it says the attacker learned the engineer’s role and knew about colleagues on the wallet team. Binance also references a security write-up about a fake Homebrew site but does not say that the campaign in that write-up was the one that affected its employee.
For the Oct. 29 operation, Binance says the attacker logged into Engineer C’s computer between 17:15 and 19:56, then began moving funds through the signing service from 20:05 UTC. The company attributes the activity to North Korea, citing the FBI, which calls the activity “TraderTraitor.” North Korea denies involvement, according to the source material.
What Binance Has Not Explained
Binance has not named the internal AI tool or described what it did technically in the Oct. 20 compromise. The report, as summarized in the source material, also does not explain how the attackers obtained access to or used that tool, or provide enough detail to independently reconstruct the movement from the compromised machines to the wallet-signing service.
Some timing and scope details remain incomplete. Binance gives a 17:15–19:56 window for activity involving Engineer C’s computer without specifying a time zone, while stating that other times are UTC. The available account does not provide an independent verification of the figures for affected, frozen or replenished assets, nor a complete breakdown of their status after Oct. 31.
The attribution also remains a claim by authorities cited by Binance: the FBI blames North Korea, while North Korea denies involvement. The source material does not include a public technical attribution from an independent investigator or a response from the FBI beyond the label and attribution described.
Further Forensics and Security Changes
The next information readers will need is a more detailed account from Binance of the AI-tool access path, the permissions tied to the deployment token and the controls that allowed the signing service to be reached outside the normal withdrawal process. The company’s report should also be read alongside any subsequent updates on asset recovery, customer impact and changes to its internal security procedures.
For employers, the incident highlights practical questions about how coding tests are handled, whether employees are permitted to run untrusted repositories on work devices, and where deployment credentials are stored. Those are implications of Binance’s account, not a confirmed list of changes the exchange has already made. Binance’s published figures provide a snapshot through Oct. 31; the source material does not state a date for a further report or independent review.
Key Questions
What happened in the Binance incident?
Binance says attackers used a fake job interview to persuade an engineer to download a malicious coding assignment on a work computer. The company says access later reached a wallet-signing service, and about $6.34 billion in digital assets were affected on Oct. 29.
How much did Binance say was frozen or replenished?
Binance reported that about $2.85 billion was frozen or intercepted and that 98% of affected tokens had been replenished by Oct. 31. These figures are the company’s account; the provided material does not describe an independent audit.
Were wallet private keys stolen?
Binance said on Oct. 30 that it had found no evidence of a wallet private-key leak. Its later report describes attackers reaching the wallet-signing service, but the available source material does not establish that private keys were stolen.
What role did an internal AI tool play?
Binance says an attacker used an internal AI tool on Oct. 20 to gain control over two engineers’ machines. The company has not named the tool or explained how it enabled that access.
Who does Binance say was responsible?
Binance cites the FBI’s attribution of the activity to North Korea, under the label “TraderTraitor.” North Korea denies involvement, and the source material does not provide a separate independent attribution.
Source: ThorstenMeyerAI.com
