# Binance Hackers Used Fake Job Interviews and Internal AI for $6.3B Theft North Korean attackers exploited developer trust and internal tools to bypass security protocols. - **Source:** [The Verge](https://www.theverge.com) - **Published:** 2026-11-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0886ddfd-7c12-497f-91f7-ca646fec7043 ## Initial Breach via Malware The security compromise began in June 2026 when a developer downloaded a tampered installer via a malicious Google search advertisement. Although Binance security teams detected the initial malware and replaced the affected device, the attackers had already gained enough information about internal engineering workflows to plan their subsequent, more sophisticated infiltration. ## Social Engineering Tactics In September, attackers targeted another engineer through a sophisticated fake hiring process. By mimicking legitimate recruiters and sharing social media profiles to establish trust, they conducted multiple interview rounds. The process culminated in the engineer downloading a fake assignment that contained malware, granting the attackers a critical foothold within the company's internal systems. ## Evasion of Security Tools The attackers replaced a legitimate pyenv executable with a malicious version, employing advanced obfuscation to bypass endpoint security protection. This zero-day malware allowed them to execute commands and establish communication with external servers while actively concealing their tracks. The security tools failed to flag this specific replacement, leaving the system vulnerable to exploitation. ## Exploitation of Internal AI By October 20th, the North Korean unit known as TraderTraitor leveraged Binance’s own internal AI tool to gain control over specific wallets. This access involved compromised credentials from the engineer targeted in June and a third employee. The attackers eventually logged into the third employee’s computer on October 29th to initiate the final theft. ## MPC Wallet Limitations Binance struggled to halt unauthorized transactions because the hot wallet utilized Multi-Party Computation. This architecture meant there was no single private key available to immediately revoke malicious EIP-7702 authorizations. The decentralized nature of the security protocol, while usually a strength, prevented the rapid intervention required to stop the large-scale asset transfer during the incident. ## Financial Impact and Recovery CEO Richard Teng confirmed that no users are bearing the loss from the $6.3 billion heist. Approximately $2.85 billion in stolen assets were frozen or intercepted by the company. Binance has successfully replenished 98% of the impacted tokens, and platform withdrawals have broadly resumed for users following the completion of the security investigation. ## Unanswered Security Questions The incident highlights significant gaps in corporate security regarding job interview protocols. It remains unclear why employees were permitted to execute code on machines with access to sensitive employer material. Furthermore, Binance has provided limited details regarding the specific internal AI tool exploited by the attackers and how it facilitated the unauthorized wallet access. ## Broader Industry Implications This event serves as a stark reminder of the risks posed by sophisticated social engineering in the tech sector. As attackers increasingly combine traditional malware with internal AI tools, companies must re-evaluate their trust models. The reliance on complex cryptographic structures like MPC necessitates new, faster incident response mechanisms to mitigate future large-scale financial losses. ## Sources covering this story - https://www.theverge.com/news/1025576/binance-cyrpto-theft-explained — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._