Binance: fake job interviews opened the $6.43 billion theft

Binance on Tuesday, November 3, 2026, published how $6.43 billion left the exchange. The account runs from a Wallet DevOps engineer in June, through a fake hiring process in September, to an internal AI tool the intruder used in October to reach a third engineer. On October 29 that access was used to send transactions through the internal wallet signing service, outside the normal withdrawal path.

This desk reported the drain on October 30, when the public figure was about $6.3 billion and the company had said the system that approves withdrawals was misused. Tuesday’s note is the calendar and the staff.

June was the first door

Binance says the campaign began in June 2026 with a Wallet DevOps engineer it calls Engineer A. He was installing a widely used AI tool and took the package from a web search. The installer was a tampered Homebrew build. The company says it detected that intrusion and rotated the credentials tied to it. What the intruder kept, Binance says, was the engineer’s role and the names of colleagues on the wallet infrastructure team.

The credential rotation closed the first laptop. The roster of who to approach next was already gone.

September was a hiring process

In September the campaign reached a second engineer, Engineer B, on a legitimate job site. The approach came from someone posing as a project director. A first interview used an HR persona and a social-media profile stocked with ordinary photos and video. A second interview used someone claiming to be the chief executive of a company Binance says does not exist, and that round moved onto a common chat app. Binance has not named the firm.

Near the end, Engineer B was told to download an assignment onto the work computer. Binance says the repository ran during setup, replaced part of a normal development tool so the machine would take instructions from an outside server, and the intruder then removed forensic artifacts. This briefing stops at that impact. A recruiting exercise ran on a machine that later sat on the path to the signing service.

October reached the signing service

On October 20 the intruder used Engineer B’s computer and an internal AI tool to take control of Engineer A and of a wallet software engineer Binance calls Engineer C. Engineer A’s machine still held a token that could deploy containers.

Binance places the theft on October 29, between 17:15 and 19:56. In that window the intruder signed in on Engineer C’s computer, used credentials stolen from Engineer A, deployed a container, and started the signing-service transactions. The company says the entry points it has identified are closed. It has rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and the access around it, replaced the devices, revoked the related credentials and tokens, scanned employee machines, tightened risk controls on the wallet service, and widened behavioral detection. It is working with law enforcement, blockchain analysts, and other firms to trace and freeze what issuers can freeze.

The Hacker News reports a separate tally alongside that account: 57 suspected North Korea-linked cases Binance has stopped since the start of 2026, including fake interviews and fake developer tools. Tuesday’s note leaves this theft unattributed. The tally is a separate line.

What a wallet team copies

A laptop that holds a deploy token is a production console. Open a recruiter’s repository, a take-home assignment, or a search-result installer somewhere else: a machine with no route to wallet infrastructure, in an environment you can discard.

June is the control that failed in September. Binance says it rotated credentials after the first compromise and still lost the org chart. After any hit on a wallet engineer, warn the teammates who were named, watch their accounts, and expect the next approach to look like a job.

An internal AI tool that can act on a colleague’s workstation is an administrator. Put the same approval on it that you would put on the action it can take. Binance says it rebuilt that tool and its access controls. Treat a rebuild of the assistant as part of the incident, in the same pass as the leaked tokens.

A container-deploy token sitting on a laptop should be insufficient to move funds. Require a second person, on a second device, before the signing service accepts a transaction outside the normal withdrawal path. Alert on a deploy from a new host, a new container, and a burst of signing-service calls. The window Binance described runs a little over two hours.

When the intruder also clears forensic artifacts, an empty local log is part of the incident. Keep endpoint telemetry somewhere the laptop cannot edit. The machine that can clean itself cannot be the only record of what it did.

This briefing relies on public reporting by The Hacker News and on Binance’s November 3 account. It does not include exploit procedures.