🔍 Read the full analysis: Could A Recruiter’s AI Job Pitch Be A Cyber Trap? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance’s November 3 report says an engineer was drawn into a fake hiring process and ran a malicious coding assignment on a work computer. The company says the attacker later used access to reach a deployment token and Binance’s wallet signing service; the FBI attributes the activity to North Korea, which denies involvement.
Binance says a fake recruiting process helped attackers gain access to its systems before an October 29 incident that affected about $6.34 billion in digital assets. In a report published November 3, the company described a malicious coding assignment run on an employee’s work computer, later access to a container deployment token, and use of an internal AI tool during the intrusion.
According to Binance, a software engineer was contacted on a legitimate job-hunting platform in September by someone posing as a project director. The engineer took part in a video interview with a fake human-resources representative, then spoke with someone claiming to be the CEO of a company Binance says did not exist. The engineer was instructed to download a coding assignment repository onto a Binance work computer.
Binance says malicious code ran during setup and that the malware was not detected by the endpoint security tools in place at the time. The company says the attackers later used an internal AI tool on October 20 to gain control of the affected engineer’s machine and two other employees’ computers. The report does not explain how that tool was used to obtain access.
On October 29, Binance says, the attacker used credentials associated with one engineer and found a container deployment permission token on another’s computer. The attacker deployed a container and ran a script that reached Binance’s wallet signing service, outside the normal withdrawal process. Binance says about $2.85 billion was frozen or intercepted and that it replenished 98 percent of affected tokens by October 31 using its own funds.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
Hiring Became an Entry Point
The account matters because it describes an attack route that began with a routine-looking hiring interaction rather than a direct assault on a wallet. A convincing interview and coding task can exploit an employee’s trust and familiarity with developer workflows. In this case, Binance says the assignment was run on a work machine, where the attackers could reach systems and credentials relevant to its wallet operations.
The reported role of a deployment permission token also highlights how a compromised endpoint can become a path toward sensitive services. Binance’s description says the attacker did not simply withdraw funds through the ordinary process; instead, the attacker reached the signing service and induced it to act. That distinction is relevant to companies that rely on internal systems to authorize high-value transactions.
For job seekers and employers, the practical warning is narrower than a claim that all online recruiting is unsafe: treat requests to run unfamiliar code on a work device as a security risk. Organizations can also review how developer credentials are stored and how access to signing and deployment systems is limited. Binance’s report does not establish that any specific safeguard would have prevented this incident.
Popular right now
Sony BRAVIA XR8B 65-Inch 4K OLED Google TV (K-65XR8B)
Philips Café Aromis Automatic Espresso Machine with LatteGo Pro Milk System
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Hazelnut Taupe
As an affiliate, we earn on qualifying purchases.
From Earlier Access to Wallet Signing
Binance’s report extends its earlier public account. On October 30, the company had identified a compromised DevOps engineer’s laptop as a possible factor and said it had found no evidence that wallet private keys were leaked. The November 3 report provides a longer timeline, describing activity dating back to June and the fake interview in September.
Binance says an engineer in wallet DevOps installed a tampered Homebrew installation in June while seeking to install a popular AI coding tool. The company says its security team detected the issue, replaced the device and rotated credentials. Binance does not name the AI tool, and it does not say that this June installation was the same campaign as a fake Homebrew site described in a linked security write-up.
The company characterizes the attack as a multi-stage campaign, not a single phishing incident. The FBI, as cited by Binance, attributes the activity to North Korea and uses the name “TraderTraitor.” North Korea denies involvement. Those attribution claims are separate from Binance’s account of the sequence of access and wallet activity.
Gaps in Binance’s Account
Binance’s report does not identify the internal AI tool or explain how the attacker used it to take control of two additional machines. It also does not name the employees or provide a technical account of how the malicious repository worked beyond saying that malware ran during setup and avoided detection by the tools then in place.
The report gives a time range of 17:15 to 19:56 on October 29 for activity involving employee computers, but does not specify a time zone for those times. Binance says funds began leaving through the signing service from 20:05 UTC. The published material does not fully detail which assets or networks account for the reported total, or how the company calculated the amount affected and the amount frozen or intercepted.
The FBI’s attribution to North Korea is reported by Binance; North Korea denies it. The available account does not provide the underlying evidence for that attribution. Further technical findings, including whether independent investigators have verified Binance’s timeline, are not included in the supplied material.
Further Incident Details Await
Binance has published its initial detailed account, but the material provided does not identify a date for a follow-up report or describe a public investigation timetable. The next developments to watch for are additional technical details about the malware, the internal AI tool’s role, and the access controls surrounding deployment tokens and wallet signing.
Companies reviewing the incident can examine how coding tests are handled, whether employees are asked to run untrusted code on work devices, and how credentials are protected when a laptop is compromised. These are prudent areas for review, not confirmed fixes announced by Binance. The scale of any changes the exchange will make, and whether authorities will release further findings, remain unknown.
Key Questions
What does Binance say happened?
Binance says an employee was approached through a job platform, interviewed by people posing as company staff and asked to run a coding assignment on a work computer. The company says attackers later used access to reach a deployment token and its wallet signing service.
How much was affected, according to Binance?
Binance reported about $6.34 billion in digital assets affected, about $2.85 billion frozen or intercepted, and said it had replenished 98 percent of affected tokens by October 31 using its own funds.
What role did an AI tool play?
Binance says an attacker used an internal AI tool on October 20 to gain control over an engineer’s machine and two other employees’ computers. The report does not name the tool or explain how it was used.
Who does the FBI say was responsible?
Binance says the FBI attributes the activity to North Korea and calls it “TraderTraitor.” North Korea denies involvement, and the supplied report does not include the evidence behind the attribution.
What should job seekers take from the report?
The account describes a request to run a coding assignment on an employee’s work computer. Treating unfamiliar code as unsafe to run on a work device is a reasonable precaution; the report does not establish that every recruiter or coding test is malicious.
Source: ThorstenMeyerAI.com
