Binance Hack Used Fake Job Interviews and Internal AI Tools

The largest cryptocurrency theft in history was executed through a sophisticated blend of social engineering and technical sabotage, according to a postmortem released by Binance. The exchange revealed that the attack unfolded over several months starting in June. The breach involved multiple stages, beginning with a developer downloading a compromised installer spread via a malicious search engine advertisement, which exposed internal details about the company's engineering workflows.

In September, the attackers shifted tactics, targeting another engineer with a deceptive job recruitment scheme. The intruder posed as a potential employer, initiating a series of phone calls and interview rounds designed to build trust. To further establish legitimacy, the impersonator shared social media pages before eventually prompting the target to download what appeared to be an interview assignment. This file was actually malware intended to infiltrate the engineer's system.

Binance stated that its security teams detected the initial malware installation in June and replaced the affected worker’s device. However, the subsequent attack proved more elusive. In the second phase, the malware deleted the legitimate pyenv executable and replaced it with a malicious version. This substitution granted the attackers backdoor access to the system, allowing them to execute commands and communicate with an external server controlled by the hackers.

The malware employed advanced obfuscation and evasion techniques to avoid detection by endpoint security tools at the time. The attackers also took deliberate steps to conceal their activity and remove traces of the compromise, making investigation significantly more difficult. By October 20, the group, identified by the FBI as a North Korean unit dubbed TraderTraitor, had gained control over wallets associated with the first compromised engineer and a third employee using Binance’s own internal AI tool.

On October 29, the attackers logged into the third employee’s computer and launched the final phase of the operation. The use of an internal corporate AI tool to aid in the breach raises questions about the integration of such technologies within secure environments and why they were able to assist the intruders in the first place, though details on the specific mechanics remain unclear.

The breach occurred despite nearly two hours passing after the first unauthorized transfers. Binance explained that the hot wallet utilized Multi-Party Computation (MPC), a security method where no single private key exists. Consequently, there was no single key that could be immediately revoked to stop the malicious EIP-7702 authorizations, preventing a quick shutdown of the transactions.

CEO Richard Teng confirmed that no individual user is bearing the financial loss from the hack. He reported that approximately $2.85 billion in stolen assets have been frozen or intercepted. At the time of the statement, 98% of impacted tokens had been replenished, with the remaining 2% being completed. Withdrawals from the platform have broadly resumed for users.

While the technical specifics of the AI tool usage remain unclear, the incident underscores long-standing warnings about the dangers of job interviews that require candidates to download and execute code on machines with access to sensitive employer materials. The attack demonstrates how social engineering can effectively bypass even robust technical defenses when trust is manipulated.

“A major crypto heist exploited social engineering and tampered software, revealing how hackers bypassed security by mimicking hiring processes.”