NewsTechCryptoBinance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heistA North Korean hacking unit reportedly started its break-in with a search engine ad that served up a malware download.A North Korean hacking unit reportedly started its break-in with a search engine ad that served up a malware download.by Richard LawlerNov 3, 2026, 10:04 PM UTCShareGiftIllustration: Alex Castro / The VergeRichard Lawler is a senior editor following news across tech, culture, policy, and entertainment. He joined The Verge in 2021 after several years covering news at Engadget.The largest crypto theft to date was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance. A postmortem from the company says the process started in June with one developer downloading a tampered installer apparently spread by a malicious Google ad, exposing details about the engineers and how they work. Then, in September, another engineer was targeted by someone pretending to be interested in hiring them; that person set up a series of calls and multiple rounds of interviews, shared social media pages to build trust, and eventually prompted them to download a fake interview assignment that was actually malware.Binance claims that its security teams did detect the first installation of malware in June, and replaced the worker’s device, but that its security tools didn’t detect the second attack that deleted the pyenv executable and replaced it with a malicious version that gave them backdoor access:The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server.
The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.By October 20th, the story goes, the attackers, whom the FBI has identified as a North Korean unit dubbed “TraderTraitor,” used Binance’s own internal AI tool to gain control over wallets for the first engineer compromised in June, as well as a third employee, before logging into the third employee’s computer on October 29th and launching their attack.RelatedBinance CEO says 90 percent of stolen assets have been ‘replenished’North Korea linked to massive Binance crypto heistAxie Infinity’s blockchain was reportedly hacked via a fake LinkedIn job offerThe postmortem also goes into why Binance wasn’t able to stop the transactions that occurred nearly two hours after the first unauthorized transfers, saying that “Because the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.” Binance says that it has prevented 57 suspected North Korea-linked cyber threat cases, and CEO Richard Teng writes that no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted: “At this moment, 98% of impacted tokens had been replenished; we’re completing the remaining 2%. Withdrawals have broadly resumed.”What’s less clear is why this particular attack worked — the danger of job interviews that ask people to download and execute code on machines with access to employer material has been warned about for years, and there’s little detail on the “internal AI tool” that was used by the attackers and why it was able to help them in the first place.Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.Richard LawlerCryptoNewsTechMost PopularOne of Google’s Android partners turned 1.3 million set-top boxes into a botnetThe 2026 iPad Mini is a terrific tiny tablet — for a big priceBambu’s nine-nozzle H3C foretells the future of 3D printingThe Elder Scrolls VI officially has a name: SentinelXbox’s former COO has ‘serious concerns’ about her abrupt departureAdvertiser Content FromThis is the title for the native ad
