🔍 Read the full analysis: Binance’s $6.3 Billion Hack Raises Questions About AI Job Scams on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance says a fake recruitment process helped attackers gain access to employees’ computers before about $6.34 billion in digital assets was affected on October 29. Its report describes malware, an internal AI tool and a deployment token in the attack chain; Binance attributes the operation to North Korea based on an FBI assessment.
Binance says attackers used a fake job interview to compromise an employee’s work computer before about $6.34 billion in digital assets was affected in an October 29 hot-wallet attack. In a detailed report published November 3, the exchange described a months-long intrusion involving previously undetected malware, an internal AI tool and a deployment permission token; the account adds detail to an attack Binance had initially linked to a compromised engineer’s laptop.
According to Binance’s report, an employee identified as Engineer B was approached in September through a legitimate job-hunting platform by someone posing as a project director. After two rounds of interviews with people presenting as company staff, the engineer was asked to download a coding assignment repository onto a work computer. Binance says malicious code ran during setup. The exchange says the malware was a zero-day that its endpoint security tools did not detect at the time, and that it replaced a normal developer tool with a malicious copy before erasing traces.
Binance’s timeline also reaches back to June, when Wallet DevOps Engineer A installed a popular AI coding tool using a tampered Homebrew installation. Binance says its security team detected that incident, replaced the device and rotated credentials; it does not name the AI tool or say that the installation was the same campaign as a fake Homebrew site discussed in a linked security write-up. On October 20, the attacker used an internal AI tool to gain control of Engineer A’s computer and a third engineer’s machine. Binance does not explain how the tool was used or how access was obtained.
On October 29, Binance says the attacker used a container deployment permission token found on Engineer A’s computer to deploy a container and trigger a script that reached the exchange’s wallet signing service. The report says the service was used outside the normal withdrawal process. Binance put the value of affected assets at about $6.34 billion, said about $2.85 billion was frozen or intercepted, and reported that 98% of affected tokens had been replenished with company funds by October 31.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
Recruitment Becomes an Attack Route
The account matters beyond the amount reported because it describes hiring as a route into company systems. A candidate’s ordinary-looking coding test became a way to run malicious code on a work machine, according to Binance. That connects a familiar workplace task—reviewing job opportunities and completing assignments—to access risks normally associated with software installation and credential theft.
The report also shows why the endpoint of a breach can differ from its beginning. Binance says the intrusion began weeks before the funds moved, and that the attackers used a deployment token and the exchange’s own signing service rather than simply taking wallet keys. For companies, the described chain puts attention on how long-lived credentials are stored, how access between teams is controlled, and how activity involving deployment and signing systems is monitored. These are implications of Binance’s account, not independently verified findings.
The AI reference needs care: Binance says an internal AI tool was used in taking control of two machines, but gives no technical explanation. The report does not establish that the AI tool itself was vulnerable or that AI independently carried out the theft. Its inclusion instead raises unanswered questions about how the tool was accessed and what permissions it had.
Products Worth Considering
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
From Laptop Alert to Full Timeline
On October 30, Binance identified a compromised DevOps engineer’s laptop as potentially involved and said it had found no evidence that wallet private keys were leaked. Analysts cited in the supplied source interpreted the available evidence as consistent with attackers using Binance’s signing system to approve transactions, rather than stealing keys. Binance’s November 3 report adds an alleged path from an external approach to access inside the company, while describing the signing service as the mechanism used to move assets.
Binance dates the activity to June and September, followed by an October 20 move across employee machines and the October 29 wallet operation. It says most of the funds left during a period beginning at 20:05 UTC, but the report’s earlier times for October 29 do not specify a time zone. The exchange calls the operation a “sophisticated, multi-stage campaign,” rather than a single isolated breach or simple phishing incident.
Binance cites the FBI, which attributes the activity to North Korea and calls it “TraderTraitor.” North Korea denies the allegation, according to the source material. The attribution is therefore an official assessment reported by Binance, not a claim that the exchange independently proves in the account.
Technical Details Still Missing
Binance’s account does not specify the name of the AI coding tool installed in June, the internal AI tool used on October 20, or how that internal tool enabled access to two employees’ computers. It also does not publish the malicious code, explain precisely how the deployment token was obtained, or detail the safeguards around the wallet signing service. Those omissions make it difficult to independently assess each step of the alleged attack chain from the account alone.
The source material provides Binance’s figures for affected, frozen or intercepted, and replenished assets, but does not give a complete accounting of the assets’ final disposition or explain how the $6.34 billion figure was calculated. The report’s stated 17:15-to-19:56 activity window has no specified time zone, while the later fund-movement time is given in UTC. The FBI attribution is also disputed by North Korea. No independent forensic findings are included in the supplied material.
Forensics and Security Changes Ahead
Binance’s November 3 report is the latest public account in the supplied material; it does not set out a schedule for additional findings. Further updates would need to clarify the internal AI tool’s role, how the attackers obtained and used the deployment token, and the exchange’s accounting of affected and recovered funds. The available source does not say whether law enforcement or outside security investigators will publish further technical details.
For employers, the described sequence points to practical questions about whether coding tests can be completed in isolated environments, whether engineers’ work devices can run untrusted repositories, and whether deployment credentials are kept off individual laptops. Binance’s report describes the incidents and response, but the supplied material does not confirm which specific policy changes the exchange has since adopted. Readers should treat those recommendations as security implications, not as announced Binance measures.
Key Questions
What happened in the Binance attack?
Binance says attackers used a fake recruitment process to get an employee to run a malicious coding assignment on a work computer. The exchange says the attackers later used employee access and a deployment token to reach its wallet signing service on October 29.
How much was affected, and how much was recovered?
Binance reported about $6.34 billion in affected digital assets, about $2.85 billion frozen or intercepted, and 98% of affected tokens replenished from its own funds by October 31. The supplied report summary does not provide a full final accounting.
What role did AI play?
Binance says an unnamed internal AI tool was used on October 20 to gain control of two engineers’ computers. It does not explain how the tool enabled access, and the report does not establish that the AI tool itself was compromised or caused the theft.
Who does Binance say was responsible?
Binance cites the FBI’s attribution of the activity to North Korea, under the label “TraderTraitor.” North Korea denies the allegation, and the supplied material does not include independent forensic findings.
What remains unknown about the attack?
The report does not name either AI tool, explain the exact access method, or provide technical details about the malware and deployment token. It also leaves open questions about the final disposition of the affected assets and the full forensic record.
Source: ThorstenMeyerAI.com
