Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Ravie LakshmananNov 03, 2026Cryptocurrency / Cyber Attack Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident," the company said. "The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method." The starting point has been traced back to a supply chain attack targeting one of its engineers from the Wallet DevOps team (named "Engineer A"), who downloaded a trojanized Homebrew installer to install a popular artificial intelligence (AI) tool after searching for it on a search engine. The incident occurred in June 2026. Although Binance said it detected the attack and rotated all related credentials as a precautionary step, the company said information about "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker." The second part of the attack occurred in September 2026, with the threat actor contacting another engineer (named "Engineer B") via a legitimate job-hunting platform by disguising themselves as a Project Director. The Project Director persona arranged a first-round interview with a human resources (HR) representative, which was then followed by a second-round interview with an individual claiming to be the CEO of a non-existent company. Binance did not disclose details of the fake company. Over the course of the first-round video interview, the HR representative shared a social media account, including personal photos and videos posted on the platform, in an attempt to build credibility and establish trust. The second round, on the other hand, took place on a popular social chat app. "Near the end of the interview, Engineer B was instructed to download an 'assignment' containing a malicious code repository onto his work computer," Binance said. "The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities." The undetected malware utilized advanced obfuscation and evasion techniques, including substituting a legitimate development tool component with a poisoned version to execute commands and establish communication with an attacker-controlled external server. In addition, the threat actor took steps to cover up tracks by removing forensic artifacts related to the compromise. The intrusion moved to the next stage on October 20, 2026, when the adversary leveraged Engineer B's compromised computer and abused an internal AI tool to gain control over Engineer A and another Wallet Software Engineer C. "The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer," Binance explained. "On 29 October between 17:15 and 19:56, the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack." The attack ultimately exploited its unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process. In response to the incident, Binance has reconstructed the affected wallet system in a new environment, as well as rebuilt the internal AI tool and access controls. Other steps taken as of November 3 are listed below - Decommissioned credentials and tokens related to affected engineers. Completed enhanced security scans across all employee devices. Enhanced AI-based behavioural anomaly detection. Strengthened wallet-service risk controls. Worked with law enforcement, blockchain intelligence firms, and industry partners to trace and freeze affected assets. "The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced," Binance said. "We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection." "We are increasing investment in AI-enabled detection, endpoint protection, developer-environment security and behavioural anomaly monitoring." Since the start of the year, Binance is estimated to have foiled 57 suspected North Korea-linked cyber threat cases, underscoring the persistent nature of the attacks targeting the cryptocurrency industry. "The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware," Binance said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, cryptocurrency, Cyber Attack, data breach, Malware, Social Engineering, Supply Chain Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen AI-Generated Fake Login Pages Are Making Account Takeovers Easier PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security