🔍 Read the full analysis: Could Your AI Job Interview Be A Cybersecurity Risk? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance says an engineer was recruited through a fake job interview and tricked into running a malicious coding assignment on a work computer. The company’s Nov. 3 account traces the campaign from earlier activity to an Oct. 29 attack that affected about $6.34 billion in digital assets; Binance says about $2.85 billion was frozen or intercepted. The report also describes use of an internal AI tool, but does not explain how it was used.
Binance says a fake engineering job interview helped attackers gain a foothold in its systems before the Oct. 29 wallet attack, which affected about $6.34 billion in digital assets. In a report published Nov. 3, the exchange described a months-long campaign involving malicious software, a deployment token and an internal AI tool, adding new detail to its earlier account of a compromised employee laptop.
According to Binance, a software engineer identified as Engineer B was contacted on a legitimate job-hunting platform in September by someone posing as a project director. After a video interview with a person presented as an HR representative and a second conversation with someone claiming to be a company CEO, the engineer was asked to download a coding assignment repository onto his work computer. Binance says malicious code ran during setup. It did not identify the job platform or the people involved.
The report places that approach within a wider sequence. Binance says an earlier incident in June involved Wallet DevOps Engineer A installing a tampered Homebrew package while trying to install an unnamed AI coding tool. The company says it detected that incident, replaced the device and rotated credentials. On Oct. 20, an attacker used an internal AI tool to gain control of Engineer A’s computer and that of another wallet software engineer, identified as Engineer C. Binance has not described the tool’s function or the method used to exploit it.
Binance says the attacker found a container deployment permission token on Engineer A’s machine. On Oct. 29, the attacker used credentials and access to deploy a container and run a script that reached the exchange’s wallet signing service, outside the normal withdrawal process. Binance reports about $2.85 billion was frozen or intercepted and that it replenished 98% of the affected tokens from its own funds by Oct. 31. The report does not provide a complete breakdown of losses or recoveries.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How a Hiring Ruse Reached Wallet Systems
The account shows why a job application can pose a security risk when an employee is asked to run code on a work device. The alleged entry point was not simply a suspicious email: Binance describes two rounds of contact, including a live video interview and a coding task presented as part of recruitment. That kind of interaction can make a malicious download appear routine, particularly when an employee’s public profile identifies their employer and technical role.
The reported access path also matters beyond hiring practices. Binance says attackers used a deployment permission token found on an engineer’s computer to reach a signing system that authorizes wallet transactions. The incident therefore raises questions about where sensitive credentials are stored, how access to signing infrastructure is limited, and whether activity outside ordinary withdrawal workflows can be stopped quickly. Binance’s figures indicate a large amount was affected, even though the company says most of the affected tokens had been replenished by Oct. 31.
The AI detail is relevant but should not be overstated. Binance says an internal AI tool was used during the Oct. 20 movement between machines; it does not say the tool itself was compromised or that AI independently carried out the attack. The report instead places the tool within a broader campaign involving social engineering, malware, credentials and deployment access.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen) – Portable Outdoor Speaker with Hi‑Fi Audio, Waterproof and Dustproof, USB‑C, Up to 12 Hours
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, Space Black
Samsung Odyssey G4 25-inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Laptop Warning to Attack Timeline
Before the Nov. 3 report, Binance had said a compromised DevOps engineer’s laptop may have been involved. On Oct. 30, the company said it had found no evidence that wallet private keys were leaked. Analysts cited in the source account interpreted the activity as attackers getting Binance’s own signing system to authorize transactions rather than stealing keys. Binance’s new report adds its account of how attackers reached that system.
Binance describes activity beginning in June, the fake recruitment approach in September, movement to other employee machines on Oct. 20, and the wallet attack on Oct. 29. It calls the campaign “a sophisticated, multi-stage campaign” and says it was not a single isolated breach or a simple phishing incident. The exchange attributes the North Korean connection to the FBI, which calls the activity “TraderTraitor”; North Korea denies responsibility.
The source says the attack’s main outflow period lasted about 20 minutes, but Binance’s report traces preparation back weeks. The company’s timeline includes times for parts of Oct. 29, though it does not state the time zone for every entry. Binance’s account is the basis for the detailed sequence; the source does not cite independent confirmation of each step.
What Binance Has Not Explained
Binance has not disclosed how the attacker used its internal AI tool, what access the tool provided, or whether a weakness in the tool was involved. It also has not named the AI coding product associated with the June tampered installation. The report does not explain how the attacker obtained or used the credentials in enough detail to independently assess each stage.
The exchange has not publicly identified the affected employees, the job platform, the social chat app, or the supposed companies and interviewers. The source material does not provide an independently verified accounting of the full financial impact, the amount ultimately recovered from attackers, or how Binance calculated the $6.34 billion figure. Binance’s claim that it found no evidence of wallet private-key leakage does not by itself establish every detail of how the signing service was accessed.
Responsibility also remains attributed rather than independently established in the material provided: Binance cites the FBI’s assessment linking the activity to North Korea, while North Korea denies involvement. Further technical evidence or findings from investigators could clarify the attribution and the specific route into the exchange’s systems.
Investigations and Security Changes
Binance says it replaced Engineer A’s device and rotated credentials after the June incident, and its Nov. 3 report provides a fuller account of the October attack. The source material does not specify what additional controls the company plans to introduce, when an investigation will be completed, or whether it will publish further technical findings. Those details remain pending.
For employers, the reported sequence points to practical areas for review: recruitment coding tasks should be isolated from company devices, deployment tokens should not be left accessible on employee laptops, and permissions to wallet signing systems should be tightly limited. Companies can also review how internal tools are authenticated and monitored. These are security implications of Binance’s account, not measures the exchange says it has adopted.
For job candidates, a request to run an unfamiliar assignment on a current employer’s computer is a warning sign. The Binance report does not establish that every technical interview exercise is dangerous; it describes a specific alleged operation in which a coding assignment carried malicious code. The next public milestones are any further Binance disclosures and updates from investigators, including clarification of the attack’s attribution, access path and final financial impact.
Key Questions
How does Binance say the attackers got in?
Binance says an engineer was approached through a job-hunting platform, interviewed by people posing as company staff and asked to run a coding assignment on a work computer. The company says malicious code ran during setup.
What role did an AI tool play?
Binance says an attacker used an internal AI tool on Oct. 20 to gain control of two engineers’ machines. It has not explained how the tool was used or said that the tool itself was compromised.
How much did the attack affect?
Binance reported about $6.34 billion in digital assets affected and said about $2.85 billion was frozen or intercepted. It also said it replenished 98% of the affected tokens from its own funds by Oct. 31.
Were wallet private keys stolen?
Binance said on Oct. 30 that it found no evidence of a wallet private-key leak. Its later report says attackers reached the wallet signing service, but the material provided does not offer an independent verification of every technical detail.
Who does Binance say was responsible?
Binance cites the FBI’s attribution of the activity to North Korea, under the name “TraderTraitor.” North Korea denies responsibility, and the source material does not provide independent confirmation of the attribution.
Source: ThorstenMeyerAI.com
