🔍 Read the full analysis: 5 Signs A Recruiter Reaching Out About AI Could Be Fake on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Binance’s Nov. 3 account says a fake job interview led an engineer to run a malicious coding assignment on a work computer, helping attackers access systems used in the October hot-wallet theft. The company also says an internal AI tool was used in the attack, but has not explained how. These details are Binance’s findings; the FBI attributes the activity to North Korea, which denies responsibility.
Binance says a fake recruiting approach helped attackers gain access to employee devices before the Oct. 29 theft affecting about $6.34 billion in digital assets from its hot wallets. In a report published Nov. 3, the company said an engineer was approached through a job platform, interviewed by people posing as company staff and asked to run a coding assignment on a work computer; Binance also said an internal AI tool was used during the later intrusion.
Binance’s report describes a campaign spanning months, rather than a single phishing message. In September, an attacker posing as a project director contacted a software engineer whose profile identified his Binance work. The engineer completed two rounds of interviews, including a video call with someone presented as HR and a chat with someone posing as a company’s CEO. The company behind the supposed role did not exist, according to Binance. The engineer was then told to download a repository containing a malicious coding assignment onto his work computer.
Binance says malicious code ran during setup and that the malware was not detected by endpoint security tools at the time. The company also describes an earlier incident in June, when a Wallet DevOps engineer installed a popular AI coding tool through a tampered Homebrew installation. Binance says its security team detected that installation, replaced the device and rotated credentials. It does not identify the AI tool or say that the June installation was part of the same attack.
According to the report, on Oct. 20 the attacker used an internal AI tool to gain control of the DevOps engineer’s machine and another engineer’s machine. Binance says the attacker found a container deployment permission token on the DevOps employee’s computer. On Oct. 29, the attacker deployed a container and ran a script that reached the company’s wallet signing service, allowing funds to be moved outside the normal withdrawal process. Binance said about $2.85 billion was frozen or intercepted and 98% of affected tokens had been replenished with company funds by Oct. 31.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
Recruiting Can Expose Company Systems
The account shows how a hiring process can be used to target a company employee, rather than simply to steal a candidate’s personal information. A plausible interview and coding task can provide a route to a work device, while access tokens on that device may grant permissions beyond the employee’s immediate tasks. Binance’s description makes clear that the job approach was one part of a longer chain, not the entire explanation for how funds were taken.
For employers, the incident points to risks in running untrusted code on work machines and storing deployment credentials on endpoints. For job seekers, a request to run an assignment on a current employer’s device is a warning sign. Those precautions are sensible, but the Binance report does not establish that the same tactic is behind other recruiting approaches or attacks.
Popular right now
De'Longhi Dinamica Plus Fully Automatic Espresso Machine
Dyson W1 PencilWash Wet and Dry Cleaner with Dok Cordless Wet Floor Cleaner
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
From Device Access to Wallet Signing
Binance’s Nov. 3 report adds detail to its initial account from Oct. 30, when the company said a compromised DevOps engineer’s laptop may have been involved and reported no evidence that wallet private keys had leaked. The new account describes a route to the internal signing service. Binance says the attacker used that service to authorize transactions, rather than taking the private keys themselves.
The company dates some activity to June and the recruiting approach to September; it says the attacker took further steps on Oct. 20 before funds began leaving on Oct. 29. The report calls the operation a multi-stage campaign. The FBI, as cited by Binance, attributes the activity to North Korea and uses the name TraderTraitor. North Korea denies involvement. The attribution remains a claim by the U.S. government, not an independently established finding in the material provided.
How the AI Tool Was Used
Binance has not named the internal AI tool or described how the attacker used it to access the two employee machines. The report also does not establish whether the June tampered Homebrew installation was connected to the September fake interview or the later intrusion. Binance says the earlier device was replaced and credentials rotated, but the supplied account does not explain how attackers proceeded after those measures.
The report does not name the employees or provide a full technical account of the attacker’s movements. It gives a period of 17:15 to 19:56 on Oct. 29 for activity on an engineer’s computer, without specifying a time zone for that period. Binance separately says funds began leaving through the signing service at 20:05 UTC. The FBI attribution is cited by Binance, while North Korea denies responsibility; the source material does not provide independent evidence resolving that dispute.
Further Technical Details Awaited
Binance’s Nov. 3 report is its first detailed account of the attack, but the available material does not set out a date for a further update. Readers should watch for additional disclosure from the company about the internal AI tool, the source and scope of the stolen deployment token, and any changes to access controls or device security. The company said it had replenished 98% of affected tokens by Oct. 31; the report does not clarify the status of the remaining 2%.
For now, the confirmed public account is Binance’s description of its own investigation, alongside the FBI attribution reported by the company and North Korea’s denial. Further technical findings or independent reporting may clarify which steps were confirmed and how the attackers reached the signing service.
Key Questions
What did Binance say happened?
Binance said an attacker used a fake recruiting approach and malicious coding assignment to compromise an engineer’s work computer, then accessed other systems and a wallet signing service. The company reported about $6.34 billion in digital assets affected by the Oct. 29 attack.
How was the fake recruiting approach used?
According to Binance, an engineer was contacted on a legitimate job platform, interviewed by people posing as company staff and asked to download a coding assignment repository to a work computer. Binance says malicious code ran during setup.
What role did an AI tool play?
Binance says the attacker used an internal AI tool on Oct. 20 to gain control of two employees’ machines. The company has not named the tool or explained how it was used.
Did Binance say that private keys were stolen?
No. Binance’s earlier account said there was no evidence of a wallet private key leak. Its later report says the attacker used the company’s wallet signing service to authorize transactions outside the normal withdrawal process.
Who does the FBI say was responsible?
Binance says the FBI attributed the activity to North Korea and called it TraderTraitor. North Korea denies involvement, and the material provided does not independently resolve the attribution.
Source: ThorstenMeyerAI.com
