Binance says attackers used a fake job interview and an internal AI tool in Oct. 29 attack

Binance said Tuesday, Nov. 3, in its first report on the Oct. 29 attack that attackers combined a tampered software installer, a fake job interview and an internal AI tool before assets were moved out of its hot wallets, Reuters reported. Binance’s report, posted on X, puts the impact at about $6.34 billion in digital assets and says, “This should not have happened.” Reuters put the theft at $6.3 billion.

Binance called it a “sophisticated, multi-stage campaign” that combined social engineering, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. The report says the campaign began in June, when an engineer on its Wallet DevOps team downloaded a tampered Homebrew installation to install a popular AI coding tool he had searched for. Binance did not name the coding tool. It said it detected the anomaly and replaced the device, but the engineer’s role and his wallet-team colleagues were exposed. Reuters said the campaign began with an advertisement for a tampered version of a coding tool.

In September, a second engineer was contacted on a job-hunting platform by someone posing as a project director at a fictitious company, Binance said. A purported HR representative held a live video interview and shared a social media account to build trust. In a second interview on a chat app, a person claiming to be the CEO told him to download an “assignment” with a malicious code repository onto his work computer. Binance said the “0-day malware was not detected by the endpoint security protection tools at the time.”

On Oct. 20, Binance said, the attacker used that engineer’s computer and “used an internal AI tool to gain control over” the first engineer and a third engineer. The attacker found a container deployment permission token on the first engineer’s computer. On Oct. 29, the attacker logged onto the third engineer’s computer, used credentials stolen from the first to deploy a container and trigger a malicious script, and exploited access to an internal wallet signing service to start transactions outside the normal withdrawal process, the report said.

The Verge noted the report gives little detail on the internal AI tool or why it helped the attackers. Binance said it rebuilt the tool and its access controls, replaced devices, decommissioned credentials and is engaging independent security experts.

Binance said the FBI’s latest information indicates North Korea is responsible. Reuters reported that the FBI blamed a North Korean hacking group, a claim North Korea has rejected. Bloomberg reported that Binance is working with the FBI, the Secret Service and the Justice Department.

Binance said it will absorb the financial impact and that about $2.85 billion in digital assets was frozen or intercepted, subject to reconciliation and market price volatility. In a separate case that does not involve Binance, Microsoft said on Oct. 21 that a China-aligned group used an agentic AI framework in attacks that included a ConnectWise Cloud Backup compromise, AI Tech Daily reported.

Binance says attackers used a fake job interview and an internal AI tool in Oct. 29 attack

Sources