🔍 Read the full analysis: What AI Applicants Should Know About Fake Recruiters on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Binance’s November 3 report says a fake recruitment process in September led one software engineer to run a malicious coding assignment on a work computer. The company says attackers later used internal access and a deployment token to reach its wallet-signing service; the FBI attributes the activity to North Korea, which denies responsibility.
Binance says a fake job interview led one of its software engineers to download a malicious coding assignment onto a work computer, giving attackers a route into company systems before the October 29 theft of about $6.34 billion in digital assets. In a report published November 3, the exchange described a months-long operation that culminated in attackers reaching its internal wallet-signing service.
According to Binance, the engineer, identified as Engineer B, was contacted in September through a legitimate job-hunting platform by someone posing as a project director. The engineer’s profile referred to his work at Binance. The company says the process included a video interview with a fake human-resources representative, followed by a chat with someone presenting as the CEO of a company that did not exist. The engineer was then asked to download a coding assignment repository onto his work computer. Malicious code ran during setup, Binance said, and was not detected by endpoint security tools at the time.
The report says the attackers’ activity extended beyond that recruitment approach. In June, Engineer A, a wallet DevOps employee, installed a popular AI coding tool using a tampered Homebrew installation, according to Binance. The company said its security team detected that incident, replaced the device and rotated credentials. Binance did not name the AI tool. It said that on October 20 the attacker used an internal AI tool to gain control of Engineer A’s computer and that of Engineer C, another wallet software engineer. The report does not explain how the internal tool was used.
Binance says the attacker found a container deployment permission token on Engineer A’s computer. On October 29, the attacker used credentials and access associated with the engineers to deploy a container and run a malicious script, eventually reaching the wallet-signing service outside the normal withdrawal process. Binance reported about $6.34 billion impacted, about $2.85 billion frozen or intercepted, and said 98% of affected tokens had been replenished from its own funds by October 31. The company said it found no evidence that wallet private keys were leaked.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How Hiring Became an Entry Point
The account shows how a recruitment interaction can expose an employer to security risk when a candidate runs code on a company device. A coding test can look routine, but a repository or setup process may execute software that gives an attacker access. Binance’s description makes the interview more than a job-seeker cautionary tale: it was one stage in a wider campaign aimed at people whose roles connected to wallet infrastructure.
For employers, the reported path underscores the risk of leaving powerful credentials or deployment permissions on workstations. A compromised device may provide access that attackers can use to reach sensitive systems without directly stealing private keys. For applicants, the practical boundary is clear: do not run a prospective employer’s code on a current employer’s computer. Verify the recruiter and company independently, and use an isolated environment approved for testing when one is available.
The incident also puts AI tools into the account, but the report does not establish that AI itself caused the breach. Binance says a tampered installation of an unnamed coding tool was involved in an earlier event and that an internal AI tool was later used in the attackers’ activity. Those descriptions leave open what the tools did and how much they contributed relative to stolen credentials and the deployment token.
Products Worth Considering
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
Amazon Kindle Paperwhite (2024), 16 GB, 7-inch Display, Black
As an affiliate, we earn on qualifying purchases.
From June Installation to October Theft
Binance’s earlier public comments, as summarized in the November 3 report, referred to a compromised DevOps engineer’s laptop and said the company had found no evidence of a wallet private-key leak. The new account adds the reported recruitment approach and describes how access moved among three employees’ machines. Binance calls the operation a “sophisticated, multi-stage campaign,” rather than a single phishing event.
The timeline in Binance’s report begins with the June tampered software installation, followed by the September fake recruitment process and an October 20 move between employee machines. The attack on funds followed on October 29. Binance places much of the outflow from 20:05 UTC onward, while giving an earlier activity range of 17:15 to 19:56 without specifying a time zone for that range. It says the funds were moved through its internal signing service, not through the normal withdrawal process.
The FBI attributes the activity to North Korea and calls it “TraderTraitor,” according to Binance’s report. North Korea denies the accusation. The attribution is a government claim, while Binance’s account describes the company’s findings about the attack path; the two should not be treated as the same kind of evidence.
Questions About the Attack Path
Binance’s report does not identify the job platform, the fake company, the unnamed AI coding tool or the internal AI tool. It also does not detail how the internal tool enabled access to Engineer A’s and Engineer C’s machines, or precisely how the malicious assignment established control. The exchange has not publicly named the employees.
The report gives limited technical detail about the deployment token and the controls around the signing service. It does not establish whether the June tampered installation was connected to the same attacker or campaign as the later events, beyond saying the attackers knew Engineer A’s role and his wallet-team colleagues. Binance also does not give a time zone for the 17:15–19:56 activity window. The FBI’s attribution remains disputed by North Korea.
Security and Investigation Steps
Binance says it replaced Engineer A’s device and rotated credentials after detecting the June installation. The November 3 report does not provide a full account of any further security changes, such as how deployment tokens are now stored or how access to the wallet-signing service has been revised. Those controls, along with the company’s continuing review of the incident, are key details readers and affected customers may look for in future updates.
Companies hiring engineers can review how they handle coding tests, verify recruiter identities, and prevent development credentials from remaining accessible on employee laptops. Applicants can confirm opportunities through an employer’s independently verified contact channels and avoid running unfamiliar code on devices belonging to a current employer. Further technical findings, details about recovery, and any additional law-enforcement information remain dependent on disclosures from Binance and investigators.
Key Questions
How did the fake recruiter reportedly gain access?
Binance says an engineer was approached on a legitimate job platform, interviewed by people posing as company staff, and asked to run a coding assignment on a work computer. The company says malicious code ran during setup.
Did attackers steal Binance wallet private keys?
Binance said it found no evidence of a wallet private-key leak. It said attackers instead reached the internal wallet-signing service and used it outside the normal withdrawal process.
What role did AI tools play?
Binance said an employee installed an unnamed popular AI coding tool through a tampered Homebrew installation in June, and that attackers later used an internal AI tool during their access to employee machines. The report does not explain how the internal tool was used or establish that AI itself caused the breach.
Who does the FBI say was responsible?
Binance says the FBI attributes the activity, which it calls “TraderTraitor,” to North Korea. North Korea denies responsibility.
What should job applicants do with coding assignments?
Do not run a prospective employer’s code on a current employer’s device. Verify recruiters and companies through independently confirmed channels, and use an isolated, approved testing environment if you need to run unfamiliar code.
Source: ThorstenMeyerAI.com
