🔍 Read the full analysis: How AI Job Hunters Can Recognize A Fake Recruiter on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Binance’s November 3 report says a software engineer was targeted through a fake recruitment process and ran a malicious coding assignment on a work computer. The exchange says the attackers later used an internal AI tool and a deployment token to reach its wallet signing system; it reports about $6.34 billion in digital assets were impacted, with about $2.85 billion frozen or intercepted.
Binance says a fake job interview helped attackers gain access to an employee’s work computer before the exchange’s October 29 wallet incident, according to a detailed report published November 3. The account describes a malicious coding assignment, later use of an internal AI tool and a deployment token, and about $6.34 billion in digital assets impacted, making the case a warning for employers and job seekers about recruitment scams that target workplace systems.
Binance’s report says a software engineer was contacted in September through a legitimate job-hunting platform by someone posing as a project director. The engineer took part in a video interview with a supposed human-resources representative, then spoke with a person claiming to be a company chief executive through a chat app. That person sent a coding assignment in a repository, which the engineer downloaded onto a Binance work computer.
Binance says malicious code ran during setup and that the malware was not detected by endpoint security tools at the time. The company describes it as previously unseen malware that replaced a normal developer tool with a malicious copy and removed traces of its activity. The report does not name the employees and refers to them as Engineers A, B and C.
The exchange says the attacker used an internal AI tool on October 20 to gain control of the targeted engineer’s computer and two other employees’ machines. On one device, the attacker found a container deployment permission token. Binance says that on October 29 the attacker used credentials and the token to deploy a container and run a script that reached the exchange’s wallet signing service, outside its normal withdrawal process. The report puts the affected digital assets at about $6.34 billion; Binance says about $2.85 billion was frozen or intercepted and 98% of affected tokens had been replenished from company funds by October 31.
Infographic 01 · From job offer to wallet
Five steps from a fake interview to $6.34 billion
How Binance describes the campaign in its initial findings of 3 November. Engineers are named only as A, B and C.
- June · the lureEngineer A (wallet DevOps) installs “a popular AI coding tool” through a tampered Homebrew installation. Caught, device replaced, but his team is now known.
- September · the interviewEngineer B is approached on a legitimate job platform. Video call with fake HR, chat with a fake CEO, then an “assignment” to download.
- Setup · the infectionThe repository’s code runs on his work computer. 0-day malware, missed by endpoint security, swaps a developer tool for a malicious copy.
- 20 October · the jumpAn internal AI tool is used as a springboard to take over Engineers A and C. A container deployment token sits on A’s computer.
- 29 October · the theft17:15–19:56: container deployed, script triggered. From 20:05 UTC funds leave via the wallet signing service.
- Three engineers’ machines were in the path, not one laptop.
- No single private key existed to revoke the Ethereum delegation: the hot wallet used MPC.
- The delegation was cleared at 00:10 UTC on 30 October.
- The job platform and the chat app.
- The AI coding tool and the internal AI tool.
- How the internal AI tool was abused.
Source: Binance, initial findings, 3 Nov 2026. Binance gives no time zone for 17:15–19:56; its other times are UTC. Simplified; no commands or file paths reproduced.
Powered by Thorsten Meyer AI
How Fake Hiring Reaches Company Systems
The account shows how a recruitment process can become an entry point into an employer’s network. A coding task may appear to test a candidate’s skills, but downloading and running unfamiliar code on a work device can expose company systems and credentials. The key risk is not limited to job seekers: an attacker can use an employee’s routine activity to gain access that later reaches sensitive infrastructure.
Binance’s description also distinguishes initial access from the final theft. The report says the campaign began months before the October 29 transactions, and that attackers ultimately reached an internal signing service rather than simply taking wallet private keys. Binance had previously said there was no evidence of a wallet private key leak; the new report adds its account of how the attacker allegedly reached the signing process. The financial figures are Binance’s reported estimates, not an independent audit in the supplied material.
For workers, the practical warning is straightforward: do not run a prospective employer’s code on a current employer’s computer. For companies, hiring-related access should be treated as a security concern alongside software installation, endpoint monitoring and protection of deployment credentials.
Products Worth Considering
Logitech MX Keys Combo for Business Keyboard and Mouse – Graphite
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER), QHD
Apple MacBook Pro 2021 14-inch with M1 Max Chip, 64 GB RAM, 2 TB SSD, Silver
As an affiliate, we earn on qualifying purchases.
From June Install to October Attack
Binance’s timeline starts before the fake interview. In June 2026, the company says, Wallet DevOps Engineer A installed a popular AI coding tool using a tampered Homebrew installation. Binance says its security team detected that incident, replaced the device and rotated credentials. It does not identify the AI tool or establish that the June installation was part of the same operation, though it says the attackers learned the employee’s role and those of wallet-team colleagues.
In September, Engineer B was approached about a role. Binance says the assignment was the route into the engineer’s work computer. On October 20, the attacker used an internal AI tool to access Engineer A’s machine and a third engineer’s, then located the deployment token. Binance’s report places activity on October 29 between 17:15 and 19:56, but does not give a time zone for that interval. It says funds began leaving through the signing service from 20:05 UTC.
On October 30, Binance identified one employee laptop as compromised and said it had found no evidence that wallet private keys were leaked. The November 3 report adds the recruitment approach and intervening access steps. Binance calls the incident a “sophisticated, multi-stage campaign”, rather than a single isolated breach or simple phishing attempt.
Details Binance Has Not Disclosed
Several parts of the account remain unspecified in the supplied report. Binance does not name the AI coding tool installed in June or explain how its internal AI tool was used to take control of the computers. It also does not provide technical details about the malware, the fake company or the precise method used to move from the compromised devices to the signing service.
The report’s timeline gives no time zone for the 17:15-to-19:56 interval on October 29. The source material also does not include independent verification of Binance’s loss, interception or replenishment figures. Binance attributes the attack to North Korea by citing the FBI; North Korea denies the allegation. The details available here do not establish the identity of the recruiter or provide the attacker’s response.
Security Reviews and Further Findings
Binance’s report says the company replaced the device involved in the June installation and rotated credentials after detecting that incident. Its November account does not detail further changes to recruitment procedures, endpoint controls or deployment-token storage. Those steps, along with clearer reporting on how the internal AI tool and signing service were accessed, would help establish what defenses the exchange has changed since the attack.
Companies that hire software staff can reduce exposure by keeping coding tests off employees’ work devices, using isolated environments for candidate code and restricting where deployment credentials are stored and used. Job seekers can verify a recruiter through the employer’s official channels and decline requests to run code on a current employer’s machine. Further technical disclosures or investigative findings may clarify how the attack progressed and how the reported asset figures were calculated.
Key Questions
What does Binance say happened?
Binance says an employee was approached through a fake recruitment process and ran a malicious coding assignment on a work computer. It says the attacker later used an internal AI tool and a deployment token to reach its wallet signing service before the October 29 incident.
How can a job seeker spot a fake recruiter?
Verify the recruiter and role through the company’s official website or contact channels. Be cautious if a supposed employer asks you to download unfamiliar code, use an unofficial chat account or run a test task on your current employer’s device. Binance’s account shows that a plausible interview process can still be used as a route into workplace systems.
Should candidates run coding tests on a work computer?
No. Do not run code supplied by a prospective employer on a device managed by your current employer. Ask for a secure, isolated test environment or use a personal device only if doing so is permitted and the code can be handled safely.
What does Binance say about the amount affected?
Binance reported that about $6.34 billion in digital assets were impacted, about $2.85 billion was frozen or intercepted, and 98% of affected tokens had been replenished from company funds by October 31. These are figures attributed to Binance in the supplied report.
Who does Binance say was responsible?
Binance cites the FBI’s attribution of the activity to North Korea and the name “TraderTraitor.” North Korea denies responsibility, and the supplied material does not provide independent confirmation of the attribution.
Source: ThorstenMeyerAI.com
