.png "Global Insight")
A job interview that never existed has now been blamed for the largest cryptocurrency theft on record. In its first detailed account of the attack, published on November 3, Binance said hackers spent about five months working their way into the exchange's systems before draining roughly $6.34 billion from its hot wallets on October 29. The story is a warning about a much older threat than any new exploit: patient social engineering, aimed at people rather than code.
According to reports from Bleeping Computer and Nikkei Asia, drawing on Binance's incident report, the campaign began in June, when a wallet developer downloaded a tampered installer while looking online for a popular AI coding tool. That first compromise, Binance said, told the attackers who inside the company worked on wallet systems.
The fake interview
The decisive break came in September. A second software engineer who was looking for a new job was contacted through a legitimate recruitment platform by someone posing as a project director at a company that did not exist. There were two video interviews, first with a supposed human-resources representative and then with a supposed chief executive, and the fake recruiters shared personal social-media profiles to build trust. The "assignment" that followed was a code repository to install on the engineer's work machine. Inside it was custom malware that replaced a legitimate developer tool component, opened a channel to an attacker-controlled server, and went undetected by endpoint security tools at the time.
Security researchers recognise the pattern. Fake recruitment is one of North Korea's best-documented hacking techniques, tracked by some firms as "Contagious Interview". The FBI has attributed this attack to a North Korean state-backed group known as TraderTraitor; North Korea has rejected the claim, and Binance's own report cites the FBI finding without making its own attribution.
From one laptop to the wallet system
On October 20, the attackers used the compromised machine and an internal Binance AI tool to reach the computers of two wallet engineers, one of whom held a container deployment permission. Nine days later, between 17:15 and 19:56 UTC on October 29, they used stolen credentials to deploy a container and run a script that moved funds out of Binance's internet-connected hot wallets. In the first four minutes alone, 233.46 million XRP left five hot wallets for an attacker-controlled address, before other cryptocurrencies including bitcoin followed.
Binance said it has since frozen or intercepted about $2.85 billion of the stolen assets and replenished 98 percent of affected tokens from its own funds, with the balance being bought on the open market. It also said it detected and blocked 57 suspected North Korea-linked cyber threats during 2026. Separately, reporting based on a person familiar with the matter said Binance had no cyber insurance to claim against for the loss.
Why this attack matters beyond crypto
The technical details will matter to security teams, but the broader lesson is simpler and applies far beyond one exchange. The attackers did not break in through a single dramatic vulnerability. They combined a poisoned download, a believable fake employer, malware designed to evade detection, and an internal AI tool turned against its own company. Each step on its own looked routine: a developer tool, a job hunt, a coding test, an AI assistant. Together, they were enough to reach the system that signs real transactions.
For anyone hiring, job-hunting, or running a team with access to sensitive systems, the practical takeaways are uncomfortable. A coding assignment should never be run on a machine that can reach production systems. Recruitment contact, however polished, is not verification. And AI tools given broad internal access become part of the attack surface the moment one employee's machine is compromised. Binance's report is also a reminder of how long such campaigns can run unnoticed: five months passed between the first tampered download and the day the money moved. Related reading on how AI-era scams are evolving: The Pet Photo App Hiding a Deepfake Machine: How 400 Apps Fooled Apple and Google, and on a strong AI quarter elsewhere in tech: Palantir Q3 Revenue Nearly Doubles as US Commercial Sales Pass Government.
The investigation continues, with independent firms reviewing Binance's findings, and much of the stolen money still unrecovered. But the central fact is already clear: the biggest crypto heist ever did not start with a vault being cracked. It started with a job offer.