Binance Hack How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack
Binance reveals how fake job interviews, malware, and internal AI abuse enabled attackers to steal $6.34 billion. 🚨
The Binance security incident on October 29 shows how a fake recruitment process can become the entry point to critical financial infrastructure. The attackers combined social engineering, compromised developer tools, stolen credentials, and abuse of an internal AI application to reach the cryptocurrency exchange’s wallet signing systems.
“Woah – so the Binance hack was indeed via a dodgy job interview for one of its developers who was tricked into downloading malware as part of the ‘interview’ – costing the company $3bn…” the popular best-selling author and cybercrime expert Geoff White wrote on LinkedIn. “Worth noting: – The 2016 hack of Bangladesh Bank, also attributed to North Korea’s Lazarus Group of hackers, was via a job application – The 2022 theft of $625m from video game Axie Infinity happened via offering an employee a juicy job offer. RECRUITMENT IS RISK. If you’re not educating employees on this, start now… – The 2024 heist of $1.5b from Bybit relied on tricking an employee of its supplier into downloading a dodgy share trading app onto the work machine.”
In its initial findings and response update, published on November 3, Binance described the operation as a “sophisticated, multi-stage campaign.” The company estimates that approximately $6.34 billion in digital assets were affected. The FBI attributed the incident to the North Korea-linked APT “TraderTraitor,” also tracked as Lazarus Group and APT38.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident,” reads the update published by the crypto firm. “The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.”
The operation began months before the theft. In June 2026, an engineer from Binance’s Wallet DevOps team downloaded a tampered Homebrew installation while searching online for a popular AI coding tool. Binance detected the suspicious activity, replaced the device, and rotated the associated credentials, but information about the engineer’s role and colleagues had already been exposed.
The attackers then targeted another software engineer through a legitimate job-hunting platform. In September, someone posing as a Project Director arranged two interviews: first with an HR representative, then with someone claiming to be the CEO of a fictitious company. During the first video interview, the supposed HR representative shared a social media account containing personal photos and videos to establish credibility.
At the end of the second interview, the engineer was asked to download a technical assignment containing a malicious code repository onto his work computer. The malware executed during setup, replacing a legitimate development tool component with a malicious version. It used obfuscation to evade detection, executed commands, and established communication with an attacker-controlled server.