INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Binance's AI Abuse via Fake Job Interviews Led to Heist

| 2026-11-03 19:44 CRITICAL HIGH AI-ENABLED ATTACK · AUTONOMOUS PHISHING & SOCIAL ENGINEERING FRAUD & CRYPTO THEFT
JSON
Executive Summary
AI-generated
Binance reveals how fake job interviews, malware and internal AI abuse enabled attackers to steal $6.34 billion. The Binance security incident on October 29 shows how a fake recruitment process can become the entry point to critical financial infrastructure. The attackers combined social engineering, compromised developer tools, stolen credentials and abuse of an internal AI application to reach the cryptocurrency exchange’s wallet signing systems.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation Dream JobOperation Dream Job APT38APT38Contagious InterviewContagious InterviewLazarus GroupLazarus Group
Target & Sectors
DPRK DPRK governmentgovernment cryptocurrencycryptocurrency technologytechnology
Incident Timeline
‎June 2025
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
threat_actor Contagious Interview
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
organisation LinkedIn
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
organisation Socket
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages.
‎June 2026
Threat actors used compromised internal AI tools and fake job interviews to gain unauthorized control over Binance's Wallet DevOps Engineer A, allowing them to exploit Ethereum's EIP-7702 authorization mechanism.
threat_actor Contagious Interview
In September, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview .
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Binance) facebook linkedin twitter Contagious Interview Cybercrime fake recruitment Hacking information security news IT Information Security North Korea Pierluigi Paganini Security Affairs Security News
organisation Binance’s Wallet DevOps
In June 2026, an engineer from Binance’s Wallet DevOps team downloaded a tampered Homebrew installation while searching online for a popular AI coding tool.
organisation the US Department of Defense’s Cyber Crime Center
In September, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview .
organisation WaterPlum
In September, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview .
organisation the 313 General Bureau
Japan’s NPA and the FBI assess that both WaterPlum operators and some North Korean IT workers report to the same place, the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party’s Central Committee.
organisation the Munitions Industry Department
Japan’s NPA and the FBI assess that both WaterPlum operators and some North Korean IT workers report to the same place, the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party’s Central Committee.
organisation the Workers’ Party’s Central Committee
Japan’s NPA and the FBI assess that both WaterPlum operators and some North Korean IT workers report to the same place, the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party’s Central Committee.
organisation Hacking
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Binance) facebook linkedin twitter Contagious Interview Cybercrime fake recruitment Hacking information security news IT Information Security North Korea Pierluigi Paganini Security Affairs Security News
organisation IT Information Security
Follow me on Twitter:  @securityaffairs  and  Facebook  and  Mastodon Pierluigi Paganini ( SecurityAffairs  – hacking, Binance) facebook linkedin twitter Contagious Interview Cybercrime fake recruitment Hacking information security news IT Information Security North Korea Pierluigi Paganini Security Affairs Security News
infrastructure 30,000 devices
At least 30,000 devices infected across more than 100 countries, funds or credentials stolen from over 7,000 cryptocurrency wallets, and a total of 1.7 billion yen, roughly $10.71 million, funneled back to North Korea.
financial 1.7 billion yen
At least 30,000 devices infected across more than 100 countries, funds or credentials stolen from over 7,000 cryptocurrency wallets, and a total of 1.7 billion yen, roughly $10.71 million, funneled back to North Korea.
organisation Project
In September, someone posing as a Project Director arranged two interviews: first with an HR representative, then with someone claiming to be the CEO of a fictitious company.
organisation Ethereum’s EIP-7702
The attackers also exploited Ethereum’s EIP-7702 authorization mechanism to grant a malicious smart contract partial execution rights over a Binance hot wallet.
organisation Multi-Party Computation
The use of Multi-Party Computation (MPC) meant there was no single private key that could immediately invalidate the unauthorized permissions.
organisation MPC
The use of Multi-Party Computation (MPC) meant there was no single private key that could immediately invalidate the unauthorized permissions.
financial 18,270 BTC
Five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, while other transfers involved approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
financial 2,961.9 ETH
The final unauthorized transfer, involving 2,961.9 ETH, was finalized at 23:56 UTC.
‎October 20
Attackers used a compromised computer to abuse an internal AI tool and gain access to the systems of two additional employees working on Binance's wallet infrastructure.
‎October 29
Threat actors used social engineering, malicious software, and compromised internal systems to carry out a $6.34 billion attack on Binance's wallet signing service on October 29.
organisation Binance
The Binance security incident on October 29 shows how a fake recruitment process can become the entry point to critical financial infrastructure.
tactic Social Engineering
This new information was shared in an incident report published today, which details how the attackers used social engineering, malicious software, and compromised internal systems to carry out the October 29 crypto theft.
‎October 30
Binance cleared the malicious authorization at 00:10 UTC on October 30.
‎October 31
Binance absorbed the financial impact of a $6.34 billion attack, replenishing 98% of affected token assets by October 31.
general_metric 98 %
As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.
Binance says it will absorb the financial impact and has already replenished 98% of the affected token assets, based on figures reported on October 31.
financial $2.85 billion
As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.
‎2026/11/03
North Korean state-sponsored hackers, tracked as TraderTraitor and Lazarus Group, used a fake job interview to trick an employee into installing malware that compromised Binance's wallet infrastructure and stole approximately $6.34 billion in digital assets.
financial $6.34 billion
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack.
threat_actor Lazarus Group
As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.
threat_actor APT38
As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.
organisation TraderTraitor
As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38.
threat_actor Contagious Interview
Malicious job interviews Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job.
organisation DeFi
North Korean Lazarus hackers have also used similar tactics in Operation Dream Job , distributing malware disguised as employment documents to people working in software development and DeFi companies.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation Binance
Binance says fake job interview led to $6.3 billion crypto heist.
financial $6.3 billion
Binance says fake job interview led to $6.3 billion crypto heist.
organisation Project
Binance says the attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company.
infrastructure Macos
" Binance explained that the malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Ethereum
The attackers also abused Ethereum's EIP-7702 authorization mechanism, allowing them to continue stealing cryptocurrency even after the exchange suspended withdrawals.
‎November 03, 2026
Threat actors, attributed to the North Korea-linked APT "TraderTraitor" and tracked as Lazarus Group and APT38, combined social engineering, compromised developer tools, stolen credentials, and abuse of an internal AI application to target Binance's wallet signing systems.
financial $6.34 billion
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack Pierluigi Paganini November 03, 2026 Binance reveals how fake job interviews, malware and internal AI abuse enabled attackers to steal $6.34 billion.
The company estimates that approximately $6.34 billion in digital assets were affected.
threat_actor Lazarus Group
“Worth noting: – The 2016 hack of Bangladesh Bank also attributed to North Korea’s Lazarus Group of hackers was via a job application – The 2022 theft of $625m from video game Axie Infinity happened via offering an employee a juicy job offer RECRUITMENT IS RISK.
The FBI attributed the incident to the North Korea-linked APT “ TraderTraitor ,” also tracked as Lazarus Group and APT38 .
industry Cryptocurrency
General Document Context
industry Technology
General Document Context
industry Government
General Document Context
organisation Bangladesh Bank
“Worth noting: – The 2016 hack of Bangladesh Bank also attributed to North Korea’s Lazarus Group of hackers was via a job application – The 2022 theft of $625m from video game Axie Infinity happened via offering an employee a juicy job offer RECRUITMENT IS RISK.
financial $625 m
“Worth noting: – The 2016 hack of Bangladesh Bank also attributed to North Korea’s Lazarus Group of hackers was via a job application – The 2022 theft of $625m from video game Axie Infinity happened via offering an employee a juicy job offer RECRUITMENT IS RISK.
threat_actor APT38
The FBI attributed the incident to the North Korea-linked APT “ TraderTraitor ,” also tracked as Lazarus Group and APT38 .
organisation LinkedIn
“Woah – so the Binance hack was indeed via a dodgy job interview for one of its developers who was tricked into downloading malware as part of the “interview” – costing the company >$3bn…” the popular best seller author and cybercrime expert Geoff White wrote on LinkedIn .
Tactical Metrics
Metrics
financial
$625M
Stolen Funds
“Worth noting: – The 2016 hack of Bangladesh Bank also attributed to North Korea’s Lazarus Group of hackers was via a job application – The 2022 theft of $625m from video game Axie Infinity happened via offering an employee a juicy job offer RECRUITMENT IS RISK.
Metrics
infrastructure
30,000
Devices
At least 30,000 devices infected across more than 100 countries, funds or credentials stolen from over 7,000 cryptocurrency wallets, and a total of 1.7 billion yen, roughly $10.71 million, funneled back to North Korea.
Metrics
financial
¥1.7B
Financial Impact
At least 30,000 devices infected across more than 100 countries, funds or credentials stolen from over 7,000 cryptocurrency wallets, and a total of 1.7 billion yen, roughly $10.71 million, funneled back to North Korea.
Metrics
infrastructure
‎6.34
Software Version
The company estimates that approximately $6.34 billion in assets were affected, of which around $2.85 billion had been frozen or intercepted as of its November 3 update.
Metrics
infrastructure
‎2.85
Software Version
The company estimates that approximately $6.34 billion in assets were affected, of which around $2.85 billion had been frozen or intercepted as of its November 3 update.
Metrics
financial
$6.3B
Financial Impact
The company estimates that approximately $6.34 billion in assets were affected, of which around $2.85 billion had been frozen or intercepted as of its November 3 update.
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack Pierluigi Paganini November 03, 2026 Binance reveals how fake job interviews, malware and internal AI abuse enabled attackers to steal $6.34 billion.
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack.
The company estimates that approximately $6.34 billion in digital assets were affected.
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.
Metrics
financial
$2.9B
Financial Impact
The company estimates that approximately $6.34 billion in assets were affected, of which around $2.85 billion had been frozen or intercepted as of its November 3 update.
As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, while 98% of impacted token assets had been replenished as of October 31.
Metrics
financial
₿18.3K
Financial Impact
Five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, while other transfers involved approximately 970,500 SOL, 44.2 million OP and 18,270 BTC.
Metrics
financial
ETH 3K
Financial Impact
The final unauthorized transfer, involving 2,961.9 ETH, was finalized at 23:56 UTC.
Metrics
infrastructure
‎Macos
Affected Product
" Binance explained that the malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory.
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Metrics
financial
$6.3B
Stolen Funds
Binance says fake job interview led to $6.3 billion crypto heist.
Intelligence Sources
BleepingComputer 2026-11-03
Security Affairs 2026-11-03