Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
Summary: Binance said the theft of $6.43 billion in assets from its exchange resulted from a multi-stage campaign that began in June 2026 when a Wallet DevOps engineer downloaded a trojanized Homebrew installer for an AI tool found via a search engine, and continued in September 2026 when a second engineer was sent a malicious code repository as an interview 'assignment' by a fake Project Director persona. On October 29, 2026, between 17:15 and 19:56, the attacker used credentials stolen from the first engineer to log onto a third engineer's computer, deploy a container, and trigger a script that abused an internal wallet signing service to initiate transactions outside the normal withdrawal process.
What you should know: The entry point was a developer downloading a tool he searched for and an engineer opening an interview assignment on a work computer - two routine actions that ended in the largest heist on record, with the attacker reaching a wallet signing service rather than stopping at the endpoint. Binance estimates it has foiled 57 suspected North Korea-linked cases this year, and Chainalysis ties more than $14.3 million in losses over 18 months to the same fake-interview playbook.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026