The $6.34B Job Interview: How Binance Got Hired Into a Heist
The biggest crypto theft on record started with a job offer. Binance’s new incident report says attackers the FBI ties to North Korea spent five months moving through a search ad, a fake interview, and an internal AI tool before draining $6.34B.
What Happened?
On November 3, Binance published how the October 29 theft unfolded. Two wallet engineers were compromised months apart, one through a trojanized Homebrew installer and one through a rigged coding test.
The attackers abused an internal AI tool to reach more staff, grabbed a container deployment token, and pushed a malicious script into the wallet signing service. That let them sign transfers outside Binance’s normal withdrawal process.
Five months, three laptops, one signing service.
Each step looked like normal developer work. Together they gave attackers the keys to sign transfers outside Binance’s withdrawal process.
Binance caught the June install and rotated credentials. The leaked team details were enough to aim the next three moves.
The Kill Chain
- June: A wallet DevOps engineer searched for an AI tool and installed a poisoned Homebrew package. Binance caught it and rotated credentials, but details about his team had leaked.
- September: A second engineer got a recruiter message on a real job platform. After a video call with a fake HR rep and a chat with a fake CEO, they sent him a coding “assignment.” It ran malware during setup on his work laptop that antivirus missed.
- October 20: From that laptop, the attackers used an internal AI tool to get control of two more wallet engineers and found a deployment token on one of their machines.
- October 29, 17:15 to 19:56: They logged into a third engineer’s computer, deployed a container, and launched the attack script.
Why Pausing Withdrawals Didn’t Stop It
The attackers used Ethereum’s EIP-7702 feature, which lets a normal wallet run smart contract code. Through the signing service, they bundled 50 authorizations into one transaction and gave a malicious contract partial control of a Binance hot wallet.
Because it was an MPC wallet, there was no single key to revoke. The delegation kept working after withdrawals stopped and wasn’t cleared until 00:10 UTC on October 30. Most funds left in about 20 minutes, across more than 10 blockchains.
Why hitting pause didn’t stop the drain.
EIP-7702 lets a normal wallet run smart contract code. The attackers used it to hand a malicious contract partial control of a hot wallet, then the pause button no longer reached them.
Normal withdrawal
What the attackers did
Who’s Being Blamed
On October 31, the FBI pinned the theft on TraderTraitor, the North Korean unit behind the $1.5B Bybit hack in 2025, and published hundreds of attacker wallet addresses for exchanges to block.
What’s the Impact?
About $2.85B has been frozen or intercepted, roughly 45% of the total. Binance says it replenished 98% of affected assets by October 31 and will cover every user loss.
Binance says it blocked 57 suspected North Korean attempts this year. This one only had to work once.
Less than half is frozen. The rest is moving.
Binance’s own figures as of November 3. Its users are covered, because the exchange says it will absorb every loss.
Binance says it replenished 98% of affected assets by October 31. Analyst totals run slightly higher, up to $6.43B.
How to Avoid This
- Run every interview coding test in a throwaway VM, never on a work laptop
- Install developer tools only from official sources, never from search ads
- Scope deployment tokens tightly and make them expire fast
- Give internal AI tools least privilege and log every action they take
- Alert on new containers or signing requests from unusual hosts
Three Laptops, One Token, One Signing Service
Every hop here looked like ordinary developer work. Secure.com’s Digital Security Teammates walk those paths the way an attacker would and flag the moment ordinary turns strange.
- Red Teammate proves which paths reach your crown jewels, like a laptop that leads to a deployment token
- SOC Teammate joins endpoint, identity, and cloud signals, so a container launched from an odd host becomes a case someone works
- Infrastructure Security Teammate finds long-lived tokens and oversized roles before attackers do
- Governed execution keeps AI inside scoped permissions, with human approval on consequential actions and a full audit trail
- Fixed paths get attacked again to prove they stay closed