How a Fake Job Interview and a Poisoned AI Tool Cost Binance $6.43 Billion
Binance has published a detailed post-mortem on the $6.43 billion theft from its platform, and it makes for uncomfortable reading. This wasn't a smash-and-grab. It was a methodical, months-long operation that threaded through supply chain compromise, social engineering, and internal tooling abuse before anyone noticed something was seriously wrong.
The first foothold was established in June 2026. An engineer on the Wallet DevOps team, referred to as Engineer A, searched for an AI tool online and ended up downloading a trojanized Homebrew installer. Classic supply chain attack. Binance says it caught this and rotated credentials, but the damage was already partially done: the attacker had gleaned enough about Engineer A's role and his teammates to plan the next move.
That next move came in September 2026. A second engineer, Engineer B, was approached on a legitimate job platform by someone posing as a Project Director. The fake recruiter ran a two-stage interview process. First round involved an HR rep who went out of their way to seem credible, sharing personal social media content during a video call. Second round was conducted over a popular chat app, with someone claiming to be the CEO of a company that, as far as anyone can tell, doesn't exist.
Near the end of that second interview, Engineer B was told to download an assignment onto his work machine. The repository contained malicious code that executed quietly during setup. It replaced a legitimate development tool component with a compromised version, opened a channel to an attacker-controlled server, and then cleaned up after itself to minimise forensic traces. The whole thing went undetected.
By 20 October 2026, the attacker was using Engineer B's compromised machine to pivot via an internal AI tool and gain access to Engineer A and a third colleague, Engineer C. On 29 October, over a roughly two-and-a-half hour window, the attacker logged into Engineer C's machine, used credentials harvested from Engineer A, deployed a container, and triggered a malicious script. That script reached into an internal wallet signing service and began initiating transactions outside the normal withdrawal process. At that point, the theft was underway.
Binance's response involved rebuilding the affected wallet infrastructure from scratch in a new environment, replacing compromised devices, decommissioning all relevant credentials and tokens, and running enhanced security scans across the entire employee fleet. The internal AI tool was also rebuilt. Binance says it has since tightened device controls, strengthened wallet-service risk controls, and expanded AI-based behavioural anomaly detection, while also working with law enforcement and blockchain intelligence firms to trace and freeze stolen assets.
The company estimates it has blocked 57 suspected North Korea-linked intrusion attempts so far this year. That's consistent with what the broader industry has been seeing: patient, well-resourced attackers who are very good at making fake job offers look real.
The attack is a useful case study in how layered an intrusion can get before anyone pulls the alarm. No single control failure caused this. It was a supply chain hit, followed by social engineering, followed by lateral movement through internal tooling, followed by abuse of a signing service. Each stage fed the next. The $6.43 billion outcome was the product of several months of quiet, careful work.