About $6.34 billion in cryptocurrency was taken after attackers used a fake job interview to trick a Binance engineer into installing custom malware, the exchange reported.
How the fake recruiter and interviews worked
Binance says the campaign began in September when a software engineer was contacted through a legitimate job‑hunting platform by someone impersonating a Project Director at a fictitious company. The employee's profile referenced his experience at Binance, making him a high‑value target, the company said. Two staged interviews followed: a live video call with an individual posing as a human resources representative who shared a social media account to build trust, and a second interview conducted through a popular social chat application.
During the second session, the candidate was instructed to download a coding assignment from an online code repository. That repository contained malicious code which, when executed, compromised the employee’s device with custom malware that antivirus software did not detect.
Malware mechanics: a malicious pyenv replacement
Binance described the malware as a previously unseen, 0‑day threat that used obfuscation and evasion techniques. "The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker‑controlled external server," explained Binance. "The 0‑day malware was not detected by the endpoint security protection tools at the time."
On the compromised macOS device the attackers installed a replacement executable named pyenv_ in the Homebrew directory, deleted the legitimate pyenv executable, renamed the malicious file to pyenv, modified its symbolic link, and used it to spawn a Z shell (zsh) process. That replacement allowed execution of commands received from an attacker‑controlled server and helped conceal activity by removing traces of the compromise, Binance said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEscalation to wallet infrastructure and EIP‑7702 abuse
By October 20, Binance reported, attackers had used the compromised engineer's computer and an internal AI tool to take control of two additional employees working on the exchange’s wallet infrastructure. From those compromises the attackers obtained credentials and a container deployment token.
On October 29 the threat actors used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance’s wallet signing service, allowing transfers of billions of dollars in cryptocurrency across multiple blockchains. The attackers also abused Ethereum's EIP‑7702 authorization mechanism, which Binance says allowed them to continue stealing cryptocurrency even after the exchange suspended withdrawals.
Freezes, replenishment and remediation steps by Binance
Binance says it rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, approximately $2.85 billion of the stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31. Binance says it is continuing to investigate the breach and has brought in independent security firms to review its findings.
How developers, exchanges, and regulators are implicated
- Developers and security teams: the incident underlines a real‑world risk from socially engineered coding assignments delivered via recruiting channels and code repositories; the malicious replacement of a common development tool (pyenv) demonstrates how supply‑chain‑style tampering can convert a single desktop compromise into infrastructure access.
- Cryptocurrency exchanges and custodians: the sequence from a single compromised engineer to unauthorized access of a wallet signing service and cross‑chain transfers shows how credential theft and container deployment tokens can lead directly to multi‑billion dollar losses, and how authorization mechanisms (EIP‑7702) can be abused to persist after withdrawal controls are applied.
- Policymakers and incident responders: the FBI attributed the attack to North Korean state‑sponsored hackers tracked under names including TraderTraitor, Lazarus Group, Jade Sleet, and APT38, and the technique mirrors prior campaigns (Contagious Interview and Operation Dream Job) noted by cybersecurity researchers, raising questions about cross‑border attribution, threat intelligence sharing, and coordinated response options.
Binance’s report ties a high‑value, multi‑billion dollar theft to a remarkably mundane starting point: a résumé, a recruiter’s outreach, and a coding assignment. The company has frozen or intercepted roughly $2.85 billion and replenished most impacted tokens, and it has engaged outside firms to validate its findings. The immediate technical trail—replacement of a development tool executable, lateral use of an internal AI tool, theft of a container deployment token, and abuse of EIP‑7702—maps a clear path from social engineering to catastrophic operational compromise.
Whether remaining funds will be recovered in full, and what longer‑term controls will be adopted industry‑wide in response, are among the questions the ongoing independent reviews and investigations will need to answer.
