How the Binance hack unfolded: a fake recruiter, a fake job, and months of patience — Binance has now updated the timeline.
- June: A Binance engineer downloaded a fake AI tool carrying malware. Binance caught and handled it, but the attackers had already learned more about the wallet management team.
- September: Posing as a Project Director, the hacker contacted another Binance engineer through a legitimate job platform and ran two interview rounds. At the end, the engineer was asked to download a coding test laced with malware onto a company computer — the foothold was in.
- October 20: Using the compromised machine and an internal AI tool, the attackers reached two more engineers, and found information granting software deployment rights on the wallet management system.
- October 29: With the stolen access, they interfered with the internal transaction signing service and moved BTC, XRP, SOL, OP and other assets out of Binance hot wallets.
Binance also said its security team detected and blocked 57 suspected North Korea-linked cyberattacks in 2026, many using the same playbook: fake recruiters, malware hidden in software, or rigged online meeting apps.
$BTC $XRP $SOL
#binancewithdrawalscamwarning
- June: A Binance engineer downloaded a fake AI tool carrying malware. Binance caught and handled it, but the attackers had already learned more about the wallet management team.
- September: Posing as a Project Director, the hacker contacted another Binance engineer through a legitimate job platform and ran two interview rounds. At the end, the engineer was asked to download a coding test laced with malware onto a company computer — the foothold was in.
- October 20: Using the compromised machine and an internal AI tool, the attackers reached two more engineers, and found information granting software deployment rights on the wallet management system.
- October 29: With the stolen access, they interfered with the internal transaction signing service and moved BTC, XRP, SOL, OP and other assets out of Binance hot wallets.
Binance also said its security team detected and blocked 57 suspected North Korea-linked cyberattacks in 2026, many using the same playbook: fake recruiters, malware hidden in software, or rigged online meeting apps.
$BTC $XRP $SOL
#binancewithdrawalscamwarning
