Binance Details Fake Job Path to $6.43B Theft

Binance just published the how, not just the dollar figure. The October 29 drain of about $6.43 billion (~₹61,000 crore at ~₹95/$) was not a one-click phishing hit. It was a months-long campaign that mixed a trojanized Homebrew install, fake job interviews, malware on a work Mac, and abuse of an internal AI tool before the attackers reached a wallet signing service.

What happened

According to Binance's own incident write-up, covered in detail by The Hacker News and BleepingComputer, the path started in June 2026. A Wallet DevOps engineer ("Engineer A") searched for a popular AI tool, downloaded a tampered Homebrew installer, and got hit. Security caught that stage, rotated credentials, and replaced the device — but the attackers still walked away with intel on that engineer and wallet-team colleagues.

In September, another engineer ("Engineer B") got a message on a real job platform from someone posing as a Project Director. Two interviews followed: a live video call with a fake HR person who shared a social account full of personal photos to look legit, then a second round on a chat app with someone claiming to be CEO of a company that did not exist. Near the end, Engineer B was told to pull down a coding "assignment" onto a work computer. That repo ran malware during setup, swapped a real Homebrew pyenv binary for a poisoned one, and phoned home.

From October 20 the attackers used Engineer B's machine and an internal AI tool to reach Engineer A and Wallet Software Engineer C, then found a container deployment token. On October 29 between 17:15 and 19:56 they logged onto C's machine, reused stolen credentials, deployed a container, and triggered a script that abused the wallet signing service for unauthorized transfers. Binance says this was not a simple private-key leak. @TheHackersNews summarized the chain on X; BleepingComputer also posted the same day.

As of November 3 Binance says entry points are closed, devices replaced, credentials revoked, and wallet systems plus the internal AI tool rebuilt. BleepingComputer adds that about $2.85 billion in stolen assets had been frozen or intercepted. The FBI had already tied the theft to North Korea's TraderTraitor / Lazarus cluster.

Why it matters

Fake "coding assignments" and recruiter theater are now a standard playbook against crypto and DevOps staff — Contagious Interview and Operation Dream Job have been doing variants for years. What stands out here is the patient pivot through an internal AI tool and a signing service after the first June infection was supposedly cleaned. If you only train people on obvious phishing links, you will miss this. I covered the initial pause and suspected theft size in our earlier Binance hack note; this post-mortem is the missing attack path.

What to do

• Never install interview "assignments," Homebrew formulas, or AI tooling on a machine that holds wallet, signing, or deploy tokens. Use a locked-down personal laptop for recruiting homework.
• Treat internal AI assistants like any other privileged service: short-lived credentials, no lateral reach into wallet infra, and logs you actually review.
• If you hold crypto on exchanges, keep long-term bags on hardware you control — the same caution we flagged after the Trezor reseller implant warning.
• Read Binance's own report and the THN / BleepingComputer write-ups before repeating secondhand numbers; the investigation is still open to independent review.