Binance reveals details of $6.3B crypto heist using fake job interviews

Cryptocurrency exchange Binance has published a detailed postmortem of a security incident that resulted in the largest crypto theft to date, amounting to $6.3 billion. According to the company, the multi-month attack was executed by a North Korean hacking unit identified by the FBI as TraderTraitor.

• The attack started in June when a developer downloaded a tampered installer via a malicious Google search ad.
• In September, another engineer was targeted through a sophisticated fake job interview scam involving multiple call rounds.
• Hackers bypassed endpoint security by replacing the pyenv executable with a malicious backdoor component.
• By October 20th, attackers utilized Binance's own internal AI tool to gain control over targeted employee wallets.

Attack Timeline and Social Engineering

The malicious campaign began in June when a company developer clicked on a search engine ad serving up malware. Binance's security teams detected this initial installation and replaced the worker's device, but the threat actors persisted by gathering intelligence on the engineering staff and their workflows.

In September, the hackers shifted tactics by impersonating recruiters interested in hiring another engineer. They conducted multiple interview rounds and built trust via social media pages before tricking the target into downloading a fake interview assignment containing malware.

Exploitation of Internal AI Tools

Binance's endpoint protection tools failed to detect the second wave of the attack, which involved sophisticated 0-day malware that replaced the pyenv development tool component and established communication with an external server while evading detection.

By October 20th, the attackers leveraged Binance's internal AI tool to gain unauthorized control over the crypto wallets of the engineer compromised in June and another employee. On October 29th, they logged into a third employee's computer and executed the final transfer of funds.

Impact and Recovery Measures

Binance CEO Richard Teng stated that no users are bearing losses, with about $2.85 billion frozen or intercepted, and 98 percent of impacted tokens already replenished from company reserves. Withdrawals on the platform have broadly resumed following the security assessment.

The postmortem explains that transactions could not be stopped immediately because the hot wallets utilized Multi-Party Computation (MPC), meaning there was no single private key to instantly revoke the unauthorized EIP-7702 authorizations. This massive breach highlights the growing risks associated with targeted social engineering and corporate AI tool integration.