Binance postmortem: fake job interviews and its own AI tool enabled the $6.3B crypto theft

Binance has detailed how attackers carried out the largest cryptocurrency theft on record, a $6.3 billion heist that combined malvertising, an elaborate fake hiring process and the company's own internal AI tool. According to The Verge, the exchange's postmortem traces the operation across several months and multiple employees before the funds finally moved in late October.

A malvertising campaign came first

In Binance's account, the initial foothold came in June, when a developer downloaded a tampered installer distributed through a malicious Google advertisement. Beyond infecting the machine, the incident apparently gave the attackers visibility into Binance's engineers and how they work. Binance says its security teams did detect that first malware installation and replaced the employee's device.

The fake job interview

The second stage, in September, targeted a different engineer with a social-engineering scheme long associated with North Korean operations. Someone posing as an interested recruiter arranged a series of calls and multiple rounds of interviews, and shared social media pages to build trust. The process culminated in a prompt to download what was presented as an interview assignment; the file was actually malware.

This time Binance's defenses missed it. As The Verge reports, the postmortem says the malware deleted the pyenv executable, a widely used tool for managing Python installations, and replaced it with a malicious version that provided backdoor access, executed commands and communicated with an attacker-controlled external server. Binance describes the payload as previously unseen malware that its endpoint protection tools failed to flag at the time, and says the attacker took deliberate steps to remove traces of the compromise, making both detection and investigation harder.

The internal AI tool

By October 20th, according to Binance, the attackers, identified by the FBI as a North Korean unit dubbed TraderTraitor, had used Binance's own internal AI tool to gain control over wallets belonging to the engineer first compromised in June as well as a third employee. Nine days later, on October 29th, they logged into that third employee's computer and launched the theft.

Notably, The Verge points out that the postmortem offers little detail on what this internal AI tool actually was or why it was able to help the attackers, leaving a significant question hanging over the company's explanation.

Why the transfers could not be stopped

Binance also addressed why it was unable to block transactions that began nearly two hours after the first unauthorized transfers. Because the hot wallet relied on Multi-Party Computation, there was no single private key the company could use to immediately revoke the malicious EIP-7702 authorizations the attackers had obtained on Ethereum. In other words, a wallet architecture adopted in part for security made emergency revocation of the attacker's permissions difficult once the theft was underway.

Recovery status

CEO Richard Teng wrote that no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted. He said 98 percent of impacted tokens had been replenished, the remaining 2 percent was being completed, and withdrawals had broadly resumed. Binance also claims to have prevented 57 suspected North Korea-linked cyber threat cases.

Why it matters

The scale is unprecedented, but the techniques were not. Poisoned installers pushed through search ads and fake recruitment processes that ask targets to download and run code have been warned about for years. That an exchange with dedicated security teams caught the first infection but missed the second, and that its own internal AI tool apparently became a pivot point for reaching wallet controls, illustrates the persistent gap between documented threats and operational defenses. The MPC detail is a second lesson: key architectures designed to remove single points of failure can also slow incident response when authorizations must be revoked quickly. For engineering organizations generally, the practical takeaways are familiar but now proven expensive: treat recruiter-supplied code as untrusted, verify software installers regardless of how they appear in search results, and audit exactly which internal tools can touch production systems and wallet infrastructure. The unanswered questions about the AI tool deserve attention too, because as companies wire AI assistants into internal workflows, those tools inherit access that can be turned against the organization.