"It was not a single isolated breach or a simple phishing incident," Binance wrote in a post on X on November 3, describing a months‑long, multi‑vector campaign that culminated in last week's record cryptocurrency transfers.
The fake interview of Software Engineer B
Binance says the first clear pathway into its environment began in September with a targeted social‑engineering scheme against an unnamed "Software Engineer B." An individual posing as a project director contacted the engineer via a legitimate job‑hunting platform after spotting the engineer's Binance affiliation. The adversary staged a first‑round interview using a fictitious HR representative and built rapport by sharing a social media account containing personal photos and videos.
During a second interview conducted in a popular social chat app, Engineer B was instructed to download an "assignment" — a code repository — onto his work computer. Binance reports the repository contained malicious code that executed during setup and initiated a series of unauthorized activities.
Zero‑day malware and tool replacement
Binance characterises the implanted code as "zero‑day malware" that employed obfuscation and evasion techniques to avoid endpoint detection. In one notable technique, the attackers replaced a legitimate development tool component with a malicious version, enabling command execution and communications with a command‑and‑control (C2) server.
Those techniques, coupled with the social‑engineering entry, created a foothold on Engineer B's machine that was later used to access internal tooling.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFrom internal AI tooling to wallet signing: Engineers A and C and the timeline
On October 20, according to Binance, the attacker used Engineer B's compromised computer to access an internal AI tool and from there pivoted to compromise two other employees: "Wallet DevOps Engineer A" and "Wallet Software Engineer C."
Wallet DevOps Engineer A had been scoped by the adversary as early as June after unwittingly downloading a malicious version of Homebrew — a third‑party macOS package manager — following a click on a malicious search ad. Binance stated it had "detected the anomaly, replaced the device, and rotated all related credentials" at that time, but the engineer's role had already been exposed to the attackers.
After the compromise of Engineer A's machine, the attackers discovered a container deployment permission token. On October 29, between 17:15 and 19:56 UTC, the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container and triggered a malicious script that launched the transaction‑signing operation.
Between 20:05 and 20:09 UTC on October 29, five Binance hot wallets sent 233.46 million XRP to an attacker‑controlled address. Binance hot wallets on Solana and Optimism sent around 970,500 SOL and 44.2 million OP, respectively, to attacker‑controlled addresses.
Binance's remediation, detection claims, and follow‑up actions
Binance reported that it has rebuilt the affected wallet system and the internal AI tool, tightened the AI tool's access controls, and replaced affected devices. The company said it decommissioned engineer credentials and tokens, enhanced security scans across employee devices, improved AI‑based behavioral anomaly detection, and strengthened wallet service risk controls.
Binance also said it has "detected and prevented 57 suspected North Korean attacks this year alone." The firm is conducting a review of the incident, creating a security research fund with industry partners, and increasing investment in AI‑enabled detection, protection and monitoring tools.
What this means for Developer & DevOps teams, Security operations, and Cryptocurrency exchanges
- Developer and DevOps teams: The campaign highlights the risk posed by developer machines and local tooling. Tyler Reguly, associate director, security R&D at Fortra, argued that controls around "what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user" need attention, and he warned that developer laptops are "among the hardest devices in an organization to lock down safely without being detrimental."
- Security operations and AI tooling teams: The attackers used a compromised internal AI tool as a pivot point. Binance has responded by rebuilding that tool and tightening access controls, and has said it is investing more in AI‑based anomaly detection — a direct acknowledgement that internal AI services can become an operational risk if abused.
- Cryptocurrency exchanges and wallet operators: The incident demonstrates a practical route from endpoint compromise to wallet‑signing operations via stolen container tokens and credential reuse, resulting in multi‑chain transfers (XRP, SOL, OP) in a short window of minutes.
Binance's account lays out a coordinated campaign that combined human‑targeted social engineering, supply‑chain style tampering of tooling, and abuse of internal automation to reach wallet‑signing capability. The firm has taken a suite of technical and organizational remediation steps and is funding research, but the facts leave a focused, operational question: will controls around downloads, container deployment tokens, and access to internal AI tools be materially hardened across engineering teams to prevent this precise blend of tactics from recurring?
https://www.infosecurity-magazine.com/news/fake-interview-software-engineer/
