Binance says a fake recruiter and a tampered download let attackers steal $6.43 billion. The same tricks can target any employee or job seeker.
Binance says the record $6.43 billion theft from its exchange began with a fake job interview and a tampered software download. The company, the world's largest cryptocurrency exchange, said on Tuesday that attackers targeted two of its engineers. It called the attack a "sophisticated, multi-stage campaign," not a single break-in or a simple phishing email.
The first step came in June 2026. An engineer on Binance's wallet DevOps team, called Engineer A, searched online for a popular AI tool. He downloaded an installer from Homebrew that had been tampered with. An installer is a program that sets up other software. Binance said it spotted the problem and changed all related credentials. But details about Engineer A and his colleagues on the wallet team were exposed to the attacker.
In September, the attacker contacted a second engineer, Engineer B, on a legitimate job-hunting site. The attacker posed as a Project Director. A first-round video interview followed with someone playing an HR representative, who shared a social media account full of personal photos and videos to build trust. The second round was held on a popular chat app with someone claiming to be the CEO of a company that does not exist.
Near the end, Engineer B was told to download an "assignment" onto his work computer. It contained malicious code that ran during setup. Binance said the malware hid itself well, contacted a server run by the attacker, and erased signs of its presence.
On October 20, the attacker used Engineer B's computer and an internal AI tool to gain control over Engineer A and a third engineer, Engineer C. The attacker found a permission token on Engineer A's computer. A token works like a digital key. On October 29, between 5:15 and 7:56 p.m., the attacker logged into Engineer C's computer, used that key and launched a malicious script. That gave access to an internal wallet signing service, which let the attacker start transactions outside the normal withdrawal process.
The material does not say whether any of the stolen money has been recovered. Binance also did not give details about the fake company. It said it has foiled 57 suspected North Korea-linked cases this year, but its account of this theft does not name who was behind it.
The tricks here are not limited to crypto firms. Anyone with a work computer could face them. Treat unexpected job offers with care, even on real job sites. Do not download an "assignment" onto a work computer. Be cautious about software you find through a search, especially on devices that hold company or personal data.
Never download a job "assignment" or search-result software onto a work computer without checking that the source is real.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammersKMBC 9 News has launched Scam School, a series on spotting the warning signs of scam texts and calls so you can protect your money and your family.
Read more: A local TV series shows the warning signs of phone and text scams
