Binance traces $6.3B hack to fake job interviews, compromised AI tool

A coding assignment from a prospective employer seemed like an ordinary part of a job interview. Instead, it was one step in a months-long cyberattack that ended with $6.3 billion stolen from Binance, raising questions about how exchanges protect themselves against threats that target their employees.

The attack was part of a coordinated campaign that exploited both human vulnerabilities and internal security systems, according to a postmortem released by Binance on Tuesday. The exchange’s findings detailed how hackers gradually gained access to its wallet infrastructure before the Oct. 29 theft.

According to Binance’s security report, the attack campaign began in June, when an engineer downloaded a tampered software package while setting up an AI coding tool. Although Binance detected the malware and replaced the affected device, the attackers had already gathered information about the exchange’s wallet team.

In September, attackers posing as recruiters targeted another software engineer and tricked the employee into downloading a malicious file disguised as a coding assignment. The malware compromised the engineer’s work computer and evaded the exchange’s security protections.

On Oct. 20, the attackers used the compromised computer and an internal AI tool to gain access to two additional engineers’s systems, obtaining deployment credentials that allowed them to install malicious software within Binance’s wallet infrastructure on Oct. 29.