Fake Job Interview, Poisoned Code Assignment: How Hackers Walked Off With $6 Billion From Binance
Binance has published its post-mortem on the $6.34 billion theft that rocked the crypto world last week, and the picture it paints is methodical, patient and deeply uncomfortable reading for anyone responsible for securing financial infrastructure.
The FBI has pinned the attack on TraderTraitor, the North Korean state-sponsored group with a well-documented habit of targeting crypto exchanges. Roughly $2.85 billion of the stolen funds has been frozen or intercepted so far.
"This should not have happened," Binance said in its incident report, which is at least more honest than most corporate crisis statements.
The operation ran for months. Three engineers' machines were compromised. And the entry point was not some exotic zero-day flung at a hardened perimeter. It started with a dodgy Homebrew download.
In June, a Wallet DevOps engineer searched for a popular AI coding tool and ended up downloading a tampered version of Homebrew, the macOS package manager. Binance's security team caught it, wiped the device and rotated the credentials. Damage contained, they presumably thought. Not quite. The attackers had already mapped out enough of the wallet infrastructure to know who was worth going after next.
September brought the more elaborate play. A second engineer received an approach from someone posing as a project director, who invited him to participate in two job interviews. The first was with a fake HR person who leaned on social media photos and personal videos to build a sense of authenticity. The second involved a fake CEO of a company that simply did not exist. At the end of it all, the engineer was asked to download a coding assignment onto his work machine.
The assignment was a trojan. The moment the engineer set up the repository, it executed malicious code, swapped out a component of a legitimate developer tool for a rogue version, and opened a backdoor to an attacker-controlled server. Binance notes that endpoint security tools failed to detect it at the time, which is not exactly reassuring but is at least honest.
Then on October 20, things escalated. The attackers used the infected second machine and, somehow, an internal AI tool to pivot onto the first engineer's system and a third wallet engineer's machine. Binance's report declines to explain precisely how the AI tool was abused, which is a notable omission.
From there the timeline moves quickly. The first engineer's machine held a container deployment token. On October 29, the attackers logged into the third engineer's computer, deployed a container using credentials lifted from the first engineer, and kicked off the actual theft via a malicious script.
What they targeted was Binance's internal wallet signing service. Using it, they drained XRP, SOL, OP and BTC from hot wallets. They also exploited Ethereum's EIP-7702 mechanism to hand a contract they controlled partial execution rights over a hot wallet. Because these authorizations existed directly on-chain, simply suspending withdrawals was not enough to stop them. The hot wallet used multi-party computation rather than a single private key, which meant Binance had no quick way to revoke the delegation. The last unauthorized transfer cleared just before midnight UTC, with the delegation removed shortly after.
Binance has since rebuilt the affected wallet system and the AI tool, replaced hardware and retired all credentials and tokens associated with the compromised accounts. External security firms are being brought in, and the exchange says it is setting up a research fund focused on AI security in blockchain contexts. It also disclosed it had detected and blocked 57 suspected North Korea-linked intrusion attempts this year alone, which suggests this is not a one-off.
On the geopolitical theatre front, North Korea has denied everything. Kim Yo Jong, sister of Kim Jong Un, issued a statement calling the FBI's attribution a "grave political provocation" and accusing the US of blaming Pyongyang for every cybercrime on the planet. Standard playbook.
Meanwhile, blockchain analytics firm Elliptic tracked the stolen funds moving through roughly 12,000 wallets across 11 blockchains in under four days. The laundering used automation but, Elliptic noted, showed no signs of AI agents making autonomous decisions. As of November 3, around $3.18 billion remained in theft-linked addresses. A separate technical glitch at THORChain triggered an emergency pause that inadvertently slowed the laundering operation, which is an odd kind of luck.
Binance says withdrawals have largely resumed and that 98% of affected token balances have been replenished. It has also published a zero-knowledge proof for its October 31 reserves snapshot, letting holders of 10 major tokens verify their balances are backed at least one-to-one.
The mechanics here are worth sitting with. No single catastrophic flaw brought Binance down. It was a sequence of small failures: a search engine result, a convincing recruiter persona, an undetected malware sample, an AI tool that could apparently be weaponized from a compromised endpoint. Defense-in-depth is supposed to catch exactly this kind of multi-stage campaign. Here, it did not.