Fake interview, real malware

The interview looked ordinary enough to be persuasive: a live video call, an HR representative, a chat app conversation with someone claiming to be a CEO. But behind the recruitment process sat North Korean operators who were using a fake hiring exercise to move malware onto a Binance engineer's work laptop. According to an incident report published by the cryptocurrency exchange on Tuesday, that download was one link in a chain that ended in a record-breaking $6.3 billion heist on October 29.

Binance framed the operation as something larger than a phishing email or an isolated compromise. The report described a staged campaign that combined social engineering, a supply chain intrusion, endpoint takeover, abuse of internal AI tooling, and what the exchange called an "advanced transaction-authorization method." The FBI over the weekend attributed the theft to TraderTraitor, a North Korean hacking operation tied to Lazarus Group.

A June download starts the clock

The preparation phase predates the interview by months. Binance's report says the operation began in June, when one of its engineers downloaded a malicious Homebrew installation as part of a supply chain attack. The exchange's security team detected the malware, replaced the device, and rotated all affected credentials, but the report states that the engineer's role and his colleagues on the wallet infrastructure team had already been exposed to the attacker.

That early step matters because it gave the intruders a target list. The report refers to the first affected engineer as one whose wallet infrastructure responsibilities made his access and his colleagues' access valuable.

The interview that built trust

In September, a second software engineer was contacted on a "legitimate job-hunting platform" by someone claiming to be a project director. The supposed director arranged a series of interviews with a company that did not exist. The first round was a live video call between the engineer and a fake HR representative. During that call, the interviewer shared a social media account containing personal photos and videos, according to the report, as a way to build rapport.

The second round was conducted on a "popular social chat app" with a person posing as the fake company's CEO. Toward the end of that conversation, the purported CEO told the engineer to download an "assignment" — a code repository laced with malware. When the engineer ran the setup, the code executed on his work computer and set off a series of unauthorized actions.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”

— Binance, in its incident report

How the malware hid in a dev tool

The malicious code did not arrive as an obvious executable. According to Binance, it replaced a component of a legitimate development tool with a malicious version, then executed commands and established communication with an external server controlled by the attackers. The report says the intruders also took steps to conceal the malicious script and evade detection, and that Binance's endpoint security tools did not immediately flag it.

The report laid out the sequence of file operations behind that substitution: creating a file under the pyenv directory, modifying it, deleting the valid pyenv executable, renaming the malicious file into its place, deleting the original binary path, and then creating a new symlink and spawning a zsh shell. In plain terms, the legitimate tool was removed and a same-named malicious version was dropped in to take its place.

AI tooling becomes a pivot point

Nearly a month after the interview, on October 20, the attackers used the compromised computer together with an internal AI tool to reach the machines of a wallet DevOps engineer identified in the report as Engineer A and another wallet software developer referred to as Engineer C.

On Engineer A's computer sat a container deployment permission token. The report says the attackers found it. On October 29, they accessed Engineer C's machine, used the stolen credentials tied to Engineer A to deploy a container, and triggered a script that launched the cryptocurrency-stealing attack.

The response and cleanup

Binance says it has rebuilt the compromised wallet system and the internal AI tool, and replaced all affected devices. The exchange also decommissioned every credential and token assigned to the compromised engineers. It is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze the assets.

The exchange has brought in independent cybersecurity experts to review the incident and recommend additional protections. Binance also said it is working to establish a security research fund and initiatives with AI companies and security shops focused on AI security in blockchain environments.

What the numbers show

• $6.3 billion — the value of the October 29 heist attributed to the campaign.
• June — when the supply chain attack began with a malicious Homebrew installation.
• September — when the fake job interview process contacted the second engineer.
• October 20 — when attackers used the compromised machine and an internal AI tool to reach Engineer A and Engineer C.
• October 29 — the date the container was deployed and the theft script triggered.

The recruitment channel as an attack surface

Binance's account places a job-hunting platform and a social chat app at the center of the intrusion. Neither is a security product, and neither is described in the report as compromised. They were simply the channels the operators used to reach a target and to establish enough credibility to get him to run code.

The report also notes that the attackers shared personal photos and videos during the first interview to build trust, a step Binance described as more advanced and deceptive than previously seen social engineering approaches.

Why it matters beyond one exchange

The mechanics described in Binance's report are not unique to crypto. A developer who is job-hunting, a work laptop with endpoint protection, a legitimate open-source package manager, and an internal AI tool that can be used to pivot between machines — that combination exists inside many software organizations, not just exchanges. The report's account suggests that the weakest link may not be a firewall or a patch gap but a hiring conversation conducted over ordinary consumer platforms.

It also raises questions about how much access a single compromised developer workstation can unlock. In Binance's telling, a permission token found on one engineer's machine, combined with a second engineer's desktop, was enough to deploy a container and run a theft script. Organizations that issue broad deployment tokens to individual developers may find that the blast radius of one infected laptop is larger than they assumed.

The exchange's plan to fund AI security research in blockchain environments is a recognition that the internal AI tool in this chain was not a side detail. How that research translates into practice, and whether other exchanges follow, is not yet clear from the report.