---
title: "Binance’s US$6.34bn theft ran from a fake job test through an internal AI tool"
summary: "Binance’s 3 November report traces the theft in four steps, June to 29 October: what each step relied on, and the published controls that break each link."
url: https://www.thetechbag.com/blog/binance-6-34bn-fake-job-test-internal-ai-tool
format: Analysis
desk: "Security"
area: "Endpoints & devices"
region: Global
published: 2026-11-04
facts_checked: 2026-11-04
author: TechBag (The TechBag Journal)
tags: ["Binance","crypto theft","incident report","fake job interview","Contagious Interview","WaterPlum","TraderTraitor","North Korea","Homebrew","internal AI tool","excessive agency","deployment token","CI/CD security","EIP-7702","hot wallet","endpoint security","FBI","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/binance-6-34bn-fake-job-test-internal-ai-tool.png
---

# Binance’s US$6.34bn theft ran from a fake job test through an internal AI tool

*Binance’s 3 November report traces the theft in four steps, June to 29 October: what each step relied on, and the published controls that break each link.*

Analysis · Security · Endpoints & devices · By TechBag · Published 2026-11-04 · Facts checked 2026-11-04 · Canonical: https://www.thetechbag.com/blog/binance-6-34bn-fake-job-test-internal-ai-tool

The short version

1. Binance’s report of 3 November traces the theft of about US$6.34bn in four steps over five months: a tampered Homebrew installer in June, a fake job interview whose “assignment” ran malware in September, “an internal AI tool as a springboard” on 20 October, and a container deployed with a stolen token on 29 October.[1]
2. Every link was a path the company trusted: a search result, a real job platform, an internal tool, a deployment token on a laptop. The September malware was a zero-day “not detected by the endpoint security protection tools”; the June compromise was caught, but had already shown the attacker who worked on the wallet team.[1]
3. Published guidance breaks each link: no hiring tests on company devices (FBI, 2024), fewer long-lived credentials (NSA and CISA), narrow permissions for AI tools (OWASP), approvals from separate networks before assets move (FBI). About US$2.85bn, 45% of the total, has been frozen or intercepted.[8][11][12][1]

On 30 October we reported the night itself: about US$6.3bn out of Binance’s hot wallets from 20:05 UTC, most of it in 20 minutes. What Binance could say then was that the incident may involve a “compromised DevOps engineer’s laptop”.[2] Its report of 3 November goes back five months and names three engineers, two lures and one internal AI tool. This piece reads that report step by step, asks what each step relied on, and sets each one against the controls that US, Japanese, Australian and German agencies, and OWASP, have published for exactly this kind of campaign. The question for any company whose engineers can reach money, production or customer data: which of these links would hold in your own building?

## Four steps from June to 29 October, in Binance's words

Binance calls it “a sophisticated, multi-stage campaign” and “not a single isolated breach or a simple phishing incident.”[1] In June, “Engineer A from Wallet DevOps downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine.” Homebrew is the common package manager developers use to install tools on a Mac. Binance’s security team “detected the anomaly, replaced the device, and rotated all related credentials”, but by then “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker.”[1]

In September a second engineer, B, was “contacted through a legitimate job-hunting platform by an individual posing as a Project Director”. A purported HR representative ran a live video interview, and someone “claiming to be the CEO of a fictitious company” followed. B was told to download an “assignment” containing a malicious code repository onto his work computer; the code “executed during the setup process”, replacing a legitimate development tool component with a malicious one that ran commands and talked to an attacker’s server. “The 0-day malware was not detected by the endpoint security protection tools at the time,” and the attacker removed traces of it.[1]

**Figure: Five months from a fake installer to the withdrawal, with the internal AI tool nine days before the theft**

*The attack chain and Binance's response, June to 3 November 2026, as dated in Binance's incident report*

| Date | Event | Detail |
| --- | --- | --- |
| Jun 2026 | June: tampered Homebrew | Engineer A (Wallet DevOps) installs it while looking for an AI coding tool; device replaced, credentials rotated |
| Sept 2026 | Sept: fake job interview | Engineer B runs an “assignment” repository on his work computer; a zero-day the endpoint tools miss |
| Oct 2026 | 20 Oct: AI tool as springboard | Control over engineers A and C; a container deployment token found on A's computer |
| Oct 2026 | 29 Oct: container deployed | From C's computer with A's token; hot-wallet outflows from 20:05 UTC |
| Oct 2026 | 30 Oct: delegation cleared | 00:10 UTC, after a last unauthorised transfer of 2,961.9 ETH at 23:56 |
| Oct 2026 | 31 Oct: FBI names TraderTraitor | 628 addresses listed; Binance has refilled 98% of the tokens |
| Nov 2026 | 3 Nov: Binance's report | About US$2.85bn frozen or intercepted |

Source: Binance incident report, 3 November 2026; FBI alert of 31 October as reported by SecurityWeek · as of 4 November 2026 · Binance gives no day for the June and September steps; they are placed at the start of each month

On 20 October the two threads met. “The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C.” On A’s computer (his first had been replaced in June) the attacker “soon discovered” a “container deployment permission token”. On 29 October, “between 17:15 and 19:56”, the attacker logged onto C’s computer, used A’s credentials, deployed a container and “triggered a malicious script to launch the attack.” From there it had “unauthorized access to an internal wallet signing service”, and between 20:05 and 20:09 UTC (01:35 to 01:39 on 30 October in India) five hot wallets sent 233.46 million XRP to an attacker’s address. Binance also lists about 970,500 SOL, 44.2 million OP and 18,270 BTC sent to attacker addresses.[1]

## Every link was a path the company trusted

No step in Binance’s account needed a stolen private key. Each uses something an engineer is meant to use: a search engine to find a tool, a job platform, a take-home coding test, a colleague-facing internal tool, a token that deploys containers, and a signing service that signs what the deployment asks it to. The last step used Ethereum’s EIP-7702, which, in Binance’s words, “allows an account to delegate certain execution rights to a smart contract without exposing the private key.” Through the signing service, the attacker gave “an attacker-controlled smart contract partial execution rights over a Binance hot wallet.”[1] That is why Binance could say on 30 October that it had found no evidence of a private key leak:[2] no key had to leave. And because the hot wallet used MPC, where no single party holds a whole key, “there was no single private key that could be used to immediately revoke” the authorisations; Binance built “a specialized procedure”, and at 00:10 UTC sent an authorisation from its Binance14 hot wallet to the zero address, clearing the delegation.[1]

**Figure: Four steps, four trusted paths: from a search result to the wallet's signing service**

*Binance's four stages of the attack (its own labels) and what each relied on, June to 29 October 2026*

1. 01Supply chain attack (June)Relied on: a search result and a trusted installer. Caught, but the wallet team was already exposed.
2. 02Social engineering (Sept)Relied on: a real job platform and a test run on a work computer. A zero-day the endpoint tools missed.
3. 03AI tool as springboard (20 Oct)Relied on: an internal AI tool that reached colleagues’ machines. It led to a deployment token on a laptop.
4. 04Wallet signing (29 Oct)Relied on: a token that could launch a container, and a signing service that signed for it, then an EIP-7702 delegation.

Source: Binance incident report, 3 November 2026; 'what it relied on' is TechBag's reading of that report · as of 4 November 2026

Binance has seen this pattern before. Its report says it detected and prevented 57 suspected North Korea-linked cyber threat cases in 2026, using “fraudulent job interviews, malicious software disguised as popular developer tools”, compromised software packages and browser extensions, and fake video-conferencing apps.[1] The September lure matches what a joint advisory of 18 September from Japan’s National Police Agency, the FBI, Australia’s ASD and two German agencies describes for the group it calls WaterPlum, better known as “Contagious Interview”: actors who “require job seekers participate in technical online virtual interviews or complete technical coding assignments”, and who have infected “at least 30,000 devices in more than 100 countries”.[10] Binance itself has not tied its compromise to a named campaign.[7] The June lure has a public twin too: on 1 May the SANS Internet Storm Center documented search ads leading to a fake Homebrew page that installed the MacSync stealer.[13] Binance does not say whether its June installer came the same way.

ReportedWhat Binance has not said

Which AI coding tool engineer A was looking for; what the internal AI tool is, whether it was built in-house, and how it gave the attacker “control over” two engineers; the time zone of “17:15 and 19:56”; how a deployed container reached the signing service; and the name of the job platform. SecurityWeek, BleepingComputer and The Record all note that the report does not explain how the AI tool was used.[6][7][5] The AI in this story is the internal tool: Elliptic, as SecurityWeek reported, found automation in the laundering across about 12,000 wallets on 11 blockchains but no sign of AI agents making decisions.[6]

## US$6.34bn impacted, 45% frozen, 98% refilled by Binance

“Approximately USD 6.34 billion in digital assets were impacted by the incident,” Binance says, and “approximately USD 2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility.” Separately, “as of 31 October 2026, 98% of the impacted token assets have been replenished”, verifiable on its Proof of Reserves page: Binance refilled its wallets from its own funds, which is not the same as getting the stolen assets back.[1] Our Note of 30 October reported that Tether and Circle froze about US$1.8bn of stolen stablecoins within the first hour, by TRM Labs’ reconstruction; Binance put the frozen total at about US$3bn that day.[3][2] Its 3 November figure, after reconciliation began, is US$2.85bn.

**Figure: Less than half the stolen value is frozen; Binance has refilled 98% of the tokens itself**

*Share of the US$6.34bn impacted that is frozen or intercepted (3 November) and share of impacted token assets Binance has replenished (31 October), %*

45%

Frozen or intercepted

about US$2.85bn of US$6.34bn

98%

Token assets replenished by Binance

from its own funds, as of 31 October

Source: Binance incident report, 3 November 2026; frozen share computed by TechBag · as of 4 November 2026 · Frozen: US$2.85bn ÷ US$6.34bn = 44.95%, shown as 45; Binance says the figure is subject to reconciliation and price moves

Binance does not make its own attribution: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People’s Republic of Korea is responsible.”[1] The FBI’s alert of 31 October, with the Secret Service and IRS Criminal Investigation, names TraderTraitor, lists 628 addresses (608 Ethereum, 19 Bitcoin, one Solana) and says the actors are converting the assets “primarily into Ethereum (ETH)”, as SecurityWeek reported it.[4][16] North Korea’s Kim Yo Jong called the accusation “absurd” in a statement on 2 November, The Record reported. Binance’s co-chief executive, Richard Teng, called it a “months-long campaign”.[5] Elliptic counted about US$3.18bn still in theft-linked addresses on 3 November, SecurityWeek reported.[6]

TechBag countTechBag count: the clocks inside the chain

From the June compromise to the use of the internal AI tool: about four months. From 20 October to the theft: nine days. From the first outflow (20:05 UTC on 29 October) to the delegation being cleared (00:10 UTC on 30 October): 4 hours 5 minutes, with the last unauthorised transfer at 23:56. All dates and times are Binance’s; the intervals are ours.[1]

## Six published controls, one for each link

None of the controls that break this chain is new. The FBI warned the crypto industry in September 2024 that North Korean actors use “offers of new employment”, and listed “requests to conduct a ‘pre-employment test’ or debugging exercise” as a warning sign.[8] CISA, the FBI and the US Treasury described TraderTraitor in April 2022 as sending messages that “mimic a recruitment effort” to people “often working in system administration or software development/IT operations (DevOps)”: the roles of engineers A and C.[9] Set against Binance’s four stages, six published controls each cut at least one link.

**Figure: Each link in Binance's chain has a published control that breaks it**

*Controls from FBI, CISA, NSA, joint international and OWASP guidance, mapped to the step in Binance's account they would have cut, 2022 to 2026*

Step 1 of 6

1. Hiring tests never run on a work device

Cuts September. FBI: “Avoid taking pre-employment tests or executing code on company owned laptops or devices”; insist on a virtual machine or a device the tester provides.[8] The 2026 joint advisory: “Only run unknown code inside a sandbox or virtual machine.”[10]

Source: FBI PSA I-090324-PSA; CISA AA22-108A; joint WaterPlum advisory; NSA/CISA CI/CD sheet; OWASP LLM06:2025; Binance incident report · as of 4 November 2026 · The mapping to Binance's steps is TechBag's; each control is quoted from its source

Binance’s own list of what it has done runs along the same lines: it “rebuilt the affected wallet system in a new environment”, “rebuilt the affected internal AI tool and access controls”, replaced devices, “decommissioned credentials and tokens related to affected engineers”, scanned all employee devices, strengthened “wallet-service risk controls” and AI-based behavioural anomaly detection. Next it has promised an independent third-party review, more spending on “AI-enabled detection, endpoint protection, developer-environment security”, and a security research fund with AI companies, of undisclosed size.[1]

Our viewOur view: the two links to check first

For a security team reading this, the cheapest checks are links 3 and 4: list every token on an engineer’s laptop that can deploy to production, and every internal tool, AI or not, that can act on another employee’s machine or account. Those two turned one infected laptop into control of two more, and a token into wallet access. The evidence against stopping there: Binance caught the June compromise and rotated credentials, and the chain still ran, because the zero-day in September evaded its endpoint tools. No single control in the list would have been enough on its own; the FBI and the joint advisory both ask for several at once.

In India, an attack through an AI tool is reportable within six hours

CERT-In’s Directions of 28 April 2022 require service providers, intermediaries, data centres and companies to report listed incidents within six hours of noticing them. The list includes “malicious code attacks”, attacks on systems “related to… virtual assets, virtual asset exchanges, custodian wallets”, and, as item xx, attacks or suspicious activity affecting systems “related to Artificial Intelligence and Machine Learning”. Logs of all ICT systems must be kept for a rolling 180 days within India, and virtual asset exchanges and custodian wallet providers must keep KYC and transaction records for five years.[14]

India has had its own case of the job-offer lure. In July 2025 Bengaluru police said hackers posing as recruiters offered a CoinDCX software engineer a part-time job and got malware onto his company laptop, before about US$44m was taken from an internal operational wallet; CoinDCX said customer funds were not affected (The Block, citing The Indian Express).[15] We did not find a CERT-In advisory specific to fake developer coding tests, and the September joint advisory counts more than 100 countries without naming India.[10] The FBI’s first control costs nothing to adopt in an Indian hiring process or an Indian engineering team: coding tests are run on a machine that holds no company credentials. The [endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) compares the EDR tools that sit on engineers’ laptops, and the [privileged access guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) the controls on tokens and admin access.

How we did this

Figures as of 4 November 2026, 7pm IST

The chain, its dates, times, amounts and Binance’s remediation list are from Binance’s incident report of 3 November, quoted in short passages. The report gives no day for the June and September steps and no time zone for “17:15 and 19:56”; its outflow times are UTC, and India times are UTC plus 5 hours 30 minutes. “What each step relied on” and the mapping of controls to steps are our reading. The FBI alert of 31 October, the North Korean statement, Teng’s post and Elliptic’s figures are as SecurityWeek and The Record reported them; fbi.gov did not load for us. The NSA/CISA CI/CD recommendations are quoted as the sheet’s headings, which we checked against the Western Australian Government’s security operations centre’s listing of them because the PDF host refused our request. The frozen share is US$2.85bn ÷ US$6.34bn. No figure in this piece comes from an unattributed report.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Binance, 29 October 2026 Binance Security Incident: Initial Findings and Response Update](https://www.binance.com/en/blog/community/3229153443759566763) — 3 November 2026
2. [Binance, Security Incident Update (initial findings; about US$3bn frozen)](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7) — 30 October 2026
3. [TRM Labs, North Korea steals USD 6.36 billion from Binance in the largest hack in history](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) — 30 October 2026
4. [SecurityWeek, FBI Flags Over 600 Addresses Tied to North Korea's Binance Heist](https://www.securityweek.com/fbi-flags-over-600-addresses-tied-to-north-koreas-binance-heist/) — 2 November 2026
5. [The Record, Binance CEO says 'months-long campaign' led to $6.3 billion theft as N. Korea denies responsibility](https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea) — 3 November 2026
6. [SecurityWeek, Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist](https://www.securityweek.com/rigged-coding-assignment-abused-ai-tool-opened-path-to-6-billion-binance-heist/) — 4 November 2026
7. [BleepingComputer, Binance says fake job interview led to $6.3 billion crypto heist](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/) — 3 November 2026
8. [FBI, PSA I-090324-PSA: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks](https://www.ic3.gov/PSA/2024/PSA240903) — 3 September 2024
9. [CISA, FBI and US Treasury, AA22-108A: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a) — 18 April 2022 (revised 20 April 2022)
10. [NPA and NCO (Japan), FBI, DC3, ASD's ACSC, BND and BfV, North Korean "WaterPlum" ("Contagious Interview") cyber actor group targeting IT professionals](https://www.ic3.gov/CSA/2026/260918.pdf) — 18 September 2026
11. [NSA and CISA, Defending Continuous Integration/Continuous Delivery (CI/CD) Environments](https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF) — June 2023 Headings checked against WA SOC advisory 20230630005.
12. [OWASP GenAI Security Project: LLM06:2025 Excessive Agency](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) — 2025
13. [SANS Internet Storm Center, Malicious Ad for Homebrew Leads to MacSync Stealer](https://isc.sans.edu/diary/32942) — 1 May 2026
14. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, Annexure I, 180-day logs, virtual asset records)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022
15. [The Block, Hackers used fake job offer to target CoinDCX employee, steal $44 million: report](https://www.theblock.co/post/364993/coindcx-employee-arrested-police-crypto-theft) — 31 July 2025
16. [FBI, North Korea responsible for $6 billion Binance attack (cyber alert)](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) — 31 October 2026 As reported by SecurityWeek; the page did not load for us.

Related on TechBag: the [developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) and [our Note from the night of the theft](https://www.thetechbag.com/blog/binance-hot-wallet-theft-stablecoin-freeze).

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Binance lost $6.3 billion in 20 minutes; Tether and Circle froze $1.8 billion in an hour](https://www.thetechbag.com/blog/binance-hot-wallet-theft-stablecoin-freeze) — The night itself: US$6.3bn left Binance’s hot wallets in about 20 minutes, and Tether and Circle froze US$1.8bn within an hour.

Go deeper on TechBag

- [Endpoint protection guide](https://www.thetechbag.com/browse/security/endpoint-protection) — the EDR on engineers' laptops, where a zero-day went undetected in September
- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — controls on deployment tokens and admin access that reach production
- [Developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) — secrets handling and the developer toolchain the June and September lures abused