A coding assignment connected to Binance’s internal AI tools.

In September, a Binance engineer encountered a fake recruiter on a legitimate job platform. After two rounds of interviews, the recruiter asked him to download a coding assignment that concealed malicious code. The process looked real, but the “assignment” they sent became the entry point for an attack.

The code replaces a legitimate developer tool component with a malicious version, then executes commands and contacts an external server controlled by the attackers. Binance said its endpoint security tools at the time did not detect the zero-day malware. Unbelievable—the component was swapped out, but the computer never raised an alert.

On October 20, the attacker used the infected laptop to access Binance’s internal AI tools, then took control of the wallets of the first and third engineers. The attacker lay low for more than a week before launching an attack with the stolen credentials. The trail from the coding assignment ultimately led to the wallets.

And this chain didn’t begin in September. Binance also disclosed that in June, another engineer downloaded a disguised version of Homebrew to install an AI coding tool. The security team discovered it and reset his credentials, but the attacker had still obtained information about his role and colleagues. You can reset an account, but leaked organizational intelligence doesn’t disappear with it. Think about it: the door was shut, but the information was still in the attacker’s hands.

Binance said the hot-wallet losses totaled about $6.3 billion and would be covered by SAFU and company funds. The FBI publicly attributed the incident to North Korea’s TraderTraitor activity. Binance disclosed how the attack unfolded, and the FBI provided the attribution; the ugliest part of this attack chain was how a fake job interview led from an employee’s computer to internal AI tools and wallet authorization.

In a November update, Binance said it had replenished about 98% of the affected amount, with the remainder still being purchased due to the token’s low liquidity.#Binance #CryptoSecurity