Fake job interview preceded $6.3bn Binance crypto theft

Binance has published an incident report describing how a multi-stage attack led to the theft of $6.3 billion in cryptocurrency on 29 October 2026. The report, published on 3 November 2026, says the campaign began with a supply chain compromise in June, moved through a fake job interview in September, and ended with attackers misusing the exchange's internal AI tooling to reach engineers who controlled wallet infrastructure. "Our current investigation indicates that this was a sophisticated, multi-stage campaign," the report said. "It was not a single isolated breach or a simple phishing incident."

According to The Register, the FBI attributed the theft over the weekend to TraderTraitor, a North Korean operation linked to the Lazarus Group. The report describes the crew as practised at job market scams, both posing as IT workers seeking jobs at Western firms and posing as employers to lure engineers into installing malware.

The first stage came in June, when a Binance engineer downloaded a malicious Homebrew installation. Binance's security team detected that malware, replaced the device and rotated the affected credentials. But the damage was informational: the report says the role of the engineer, referred to as Engineer A, and that of his colleagues on the wallet infrastructure team had been exposed to the attackers.

Three months later, a second engineer was contacted on what Binance called a "legitimate job-hunting platform" by someone claiming to be a project director, who set up a series of interviews with a fake company. In the first round, a live video call with a bogus HR representative, the interviewer shared a social media account including personal photos and videos "in order to build trust", the report says, calling the approach "more advanced and deceptive than previously seen social engineering approaches". A second interview, conducted on a popular chat app with someone posing as the company's chief executive, ended with the engineer being told to download an "assignment" that contained a malware-laced code repository.

The code ran on the engineer's work computer during setup. Binance said the malware replaced a legitimate development tool component with a malicious version, which executed commands and opened communications with an attacker-controlled external server. The script deleted the valid pyenv binary from a Homebrew directory and renamed a slightly larger malicious file in its place, then created a new symlink and spawned a shell. The attackers also took steps to hide the script and evade detection, and it worked: Binance's endpoint security tools did not immediately detect the malware.

On 20 October the attackers used the compromised machine and an internal AI tool to reach the computers of Engineer A, a wallet DevOps engineer, and a wallet software developer called Engineer C in the report. Engineer A's machine held a container deployment permission token, which the attackers found. On 29 October they accessed Engineer C's computer, used Engineer A's stolen credentials to deploy a container, and triggered a script that launched the theft.

Binance said it has rebuilt the compromised wallet system and the internal AI tool, replaced all affected devices, and decommissioned every credential and token assigned to the compromised engineers. It is working with law enforcement, blockchain intelligence firms and security researchers to trace and freeze the stolen assets, and has hired independent cybersecurity experts to review the incident and recommend further protections. The exchange also said it plans to set up a security research fund and joint initiatives with AI companies and security firms focused on AI security in blockchain environments.