Cryptocurrency exchange Binance has revealed how attackers used fraudulent recruitment interviews and malware-infected software to infiltrate its internal systems before stealing approximately $6.34 billion in digital assets. The company’s investigation shows that the October 29, 2026, attack resulted from a series of compromises involving multiple employees over several months.
According to Binance’s November 3 incident report, the attackers began preparing the operation as early as June, when a software engineer downloaded a modified Homebrew installation while searching for an AI development tool. Although Binance detected the suspicious software and replaced the affected device, the attackers had already obtained information that could assist further intrusions.
A separate attack began in September when another engineer received a job opportunity through a legitimate recruitment platform. The supposed employer was a fictitious company, and the individual presenting themselves as its project director was part of the deception.
The engineer participated in two interviews. During the first, someone posing as a human resources representative conducted a video call and shared a social media profile containing personal photographs and videos to establish credibility.
During the second interview, conducted through a messaging application, the supposed employer instructed the engineer to download a coding assignment from an online repository. The assignment contained previously unidentified malware that bypassed the company’s endpoint security protections.
Binance investigators discovered that the malicious software replaced a legitimate development tool component on the employee’s macOS computer. Specifically, it substituted the pyenv executable with a modified version capable of executing commands received from an attacker-controlled server.
By October 20, the attackers had combined access to the compromised computer with an internal AI tool to reach systems belonging to two additional employees involved in Binance’s cryptocurrency wallet infrastructure. They subsequently obtained credentials and a container deployment token.
On October 29, the stolen access allowed the attackers to deploy malicious code and compromise Binance’s wallet signing service. This enabled unauthorized cryptocurrency transfers across multiple blockchains without following the exchange’s normal withdrawal procedures.
The attackers also exploited Ethereum’s EIP-7702 authorization mechanism, which complicated Binance’s efforts to stop the transfers. Unauthorized activity continued even after the exchange suspended withdrawals.
The FBI has attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group also associated with the Lazarus Group. North Korea has denied involvement, while Binance has not independently confirmed the attackers’ identity.
Binance reported that approximately $2.85 billion in stolen assets had been frozen or intercepted by November 3. The company also stated that it had replenished around 98% of affected token assets using its own funds.