Binance Details $6.43 Billion Theft via Fake Interviews and AI Tool Abuse

Binance said on Tuesday that the theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the result of a sophisticated, multi-stage campaign involving social engineering, malware, and abuse of internal tooling. The company said the attack targeted two engineers and combined fake recruitment interviews, a tampered Homebrew installation, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

How the Attack Began

The starting point was a supply chain attack against an engineer from the Wallet DevOps team, referred to as Engineer A, who downloaded a trojanized Homebrew installer while searching for a popular artificial intelligence tool in June 2026. Binance said it detected that attack and rotated related credentials as a precaution, but information about Engineer A and related colleagues on the wallet infrastructure team was exposed. In September 2026, a threat actor contacted a second engineer, Engineer B, through a legitimate job-hunting platform while posing as a Project Director, then arranged interviews with an HR representative and a person claiming to be the CEO of a non-existent company.

During the first-round video interview, the HR representative shared a social media account with personal photos and videos to build trust. In the second round, held on a popular social chat app, Engineer B was told to download an assignment containing a malicious code repository onto his work computer. The repository executed malicious code during setup, and the malware used obfuscation and evasion techniques, replaced a legitimate development tool component with a poisoned version, communicated with an attacker-controlled server, and removed forensic artifacts.

Abuse of Internal Systems

On October 20, 2026, the attacker used Engineer B's compromised computer and abused an internal AI tool to gain control over Engineer A and another Wallet Software Engineer, referred to as Engineer C. The attacker found that Engineer A had a container deployment permission token on his computer. Between 17:15 and 19:56 on October 29, the attacker logged onto Engineer C's computer, used credentials stolen from Engineer A, deployed a container, and triggered a malicious script. The attack ultimately used unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process.

Response and Broader Threats

As of November 3, Binance said it reconstructed the affected wallet system in a new environment and rebuilt the internal AI tool and access controls. It replaced affected devices, decommissioned credentials and tokens related to affected engineers, completed enhanced security scans across all employee devices, enhanced AI-based behavioural anomaly detection, strengthened wallet-service risk controls, and worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets. The company said entry points used in the attack were closed and systems touched in the attack path were rebuilt or replaced.

Binance also said it is increasing investment in AI-enabled detection, endpoint protection, developer-environment security, and behavioural anomaly monitoring. Since the start of the year, it estimates it has foiled 57 suspected North Korea-linked cyber threat cases. The techniques in those cases include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware.

Earlier coverage: Binance resumes withdrawals after $6.3 billion crypto breach · North Korean hackers blamed for $6.3 billion Binance theft

Sources: The Hacker News