Binance has published its own account of how roughly $6.3 billion left its wallets on
October 29, 2026. It begins somewhere most security teams never look: a fake job interview.
A software engineer hunting for a new role downloaded what he believed was a hiring
assignment. It was malicious code, and it ran on his work laptop.
The rest is a case study in how one trusted laptop, an internal AI tool and thin separation
between engineering access and wallet-signing access become the largest crypto theft on
record.
Here is what Binance disclosed, what the FBI confirmed, and what any business should copy
from the response.
What this covers:
- What the Fake Job Interview actually involved
- The June tampered AI coding tool
- How the fake job interview reached the wallets
- Why the fake job interview worked
- October 29: four minutes, then four hours
- Five controls that beat a fake job interview
- What it means for your business
- Fake Job Interview questions
What the Fake Job Interview Actually Involved
The approach started in September 2026. Someone posing as a project director at a company
that did not exist approached a Binance software engineer through a legitimate job-hunting platform,
the exchange’s report states.
Two interview rounds followed. In the first, a supposed HR representative held a live video
call and showed a social profile stocked with personal photos and videos — enough
ordinary detail to survive a quick check.
The second round ended with an assignment the engineer was told to download and set up. It
was a malicious code repository, and Binance says its obfuscation got past the company’s
security software as it executed on his laptop.
The sequencing is the part worth studying. The payload did not arrive in the first message.
It arrived after two conversations and a visible persona, at the moment a candidate is most
motivated to cooperate.
June: The Tampered AI Coding Tool
In June 2026, a member of the wallet developer team downloaded a tampered installer while
setting up a popular AI coding tool. Reuters, citing a person familiar with the incident,
reported the malicious copy had been placed in an advertisement so it ranked above the real
download in search results.
Binance says it detected that intrusion, replaced the device and rotated credentials. What it
could not undo was the reconnaissance: the attackers already knew which engineers worked on
systems holding customer assets.
That is the quiet cost of a contained incident. The breach closed; the map it produced did
not.
How the Fake Job Interview Reached the Wallets
On October 20 the attackers combined the compromised laptop with an internal Binance AI tool
to take control of two wallet engineers’ machines.
Nine days later they used one engineer’s stolen credentials on the other’s
computer to reach the service that approves transfers, moving funds outside the normal
withdrawal process.
By then the fake job interview had done its job. It delivered a foothold inside the trust boundary, on
a device that was expected to run code, from a person whose job was to run code.
Dealing with this at your office? Talk to a local IT expert →
Why the Fake Job Interview Worked
A fake job interview works because every step is normal. Recruiters do reach out on job platforms.
Employers do ask candidates to complete a technical exercise. Developers do install tools, and
plenty of people interview while employed.
Tyler Reguly, associate director of security research at Fortra, told Nextgov the control that
has to exist is around what can be downloaded and executed on a corporate laptop, and what
permissions that user actually holds.
Michael Barnhart of DTEX told Reuters that fake interviews have been a known technique for
years, and that Binance detected and prevented 57 suspected North Korea-linked threats in
2026. The volume is the story. One attempt eventually fits.
October 29: Four Minutes, Then Four Hours
The drain was fast. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to
an attacker-controlled address.
Hot wallets on Solana and Optimism sent roughly 970,500 SOL and 44.2 million OP, and a hot
wallet sent 18,270 BTC.
The attackers also abused Ethereum’s EIP-7702 authorisation mechanism, which lets an
account delegate limited execution rights to a smart contract without exposing a private key.
They submitted 50 signing transactions to manipulate the account nonce and set those
delegations on-chain.
Binance froze about $2.85 billion by suspending withdrawals, coordinating token freezes and
revoking permissions. Suspending withdrawals could not stop everything: the on-chain authorisations
lived independently of the withdrawal system.
The hot wallet used multi-party computation, so no single private key could revoke the
delegations at once. Binance had to build and run a specialised revocation
procedure. The final unauthorised transfer landed at 23:56 GMT, nearly four hours after the
first.
The FBI attributed the theft to North Korea on October 31, referring to the activity as
“TraderTraitor”, working with the Secret Service and IRS-Criminal Investigation, and
published wallet addresses for exchanges to block. Pyongyang has denied involvement.
Binance says it set aside more than 100% of the funds to cover the loss and had replenished
98% of impacted token assets by October 31.
Five Controls That Beat a Fake Job Interview
Most advice focuses on spotting a fake recruiter. That helps and is not enough.
The controls that would have interrupted this chain are technical.
- Allowlist what can execute. A hiring exercise should not run on a
production-trust laptop simply because the user launched it. - Keep the wallet path off developer machines. Signing authority should not
be reachable from a general-purpose endpoint, even with stolen credentials. - Treat AI tools as software supply chain. Verify installers from the
vendor, pin versions, and block downloads from advertised search results. - Make revocations fast and possible. If recovery depends on a procedure
invented during the incident, the incident gets longer. Test it beforehand. - Watch identity behaviour, not just signatures. Credentials that jump
between machines are a signal, and the fake job interview produced exactly that pattern.
None of that is exotic. All of it is cheaper than four hours of unapproved transfers.
What the Fake Job Interview Means for Your Business
You are not Binance, and that is the point. The same playbook scales down: a plausible
recruiter, a take-home coding exercise, a packaged installer, a help-desk call.
What changes at a smaller company is that fewer people review what runs, and one compromised
laptop often sits close to finance, email and file access.
The recruiting angle deserves specific attention if your team hires technical staff, because
candidates are expected to run unfamiliar code as a condition of the process. Decide in advance
where that runs.
Impersonating a colleague or a vendor is the same trust problem, which is what our look at how spoofed email and lookalike messages get past staff covers.
If the endpoint is already compromised, containment depends on the fundamentals in
ransomware protection for South Florida businesses.
Nextek IT reviews endpoint execution controls, privileged access paths and identity logging
for South Florida businesses. If you cannot say today where a candidate’s coding test is
allowed to run, that is a good place to start.
Book a call with Nextek IT.
Fake Job Interview Questions
How does a fake job interview compromise a corporate laptop? The candidate is asked
to download and run a project or code repository. If the payload is obfuscated well enough it
executes without an antivirus alert, and the attacker then holds a foothold on a trusted
device.
Was this a Binance-specific weakness? The mechanics were specific to how
Binance signs wallet transactions. The entry path was not. Recruiter impersonation and malicious
developer tooling hit companies of every size.
Did the FBI confirm who was responsible? Yes. The FBI attributed the theft to
North Korea on October 31, 2026, referring to the actor as TraderTraitor. North Korea has denied
involvement.
Is Binance’s account final? No. Binance calls it an initial report and
states that its findings will be subject to further independent review.
What should a hiring manager change this week? Issue interview exercises
through a sandboxed or disposable environment, tell candidates exactly where to run them, then
confirm your endpoint policy blocks execution elsewhere.
Need IT that actually answers?
Nextek IT supports South Florida practices and businesses — medical, dental, legal, accounting — with managed IT, cybersecurity and HIPAA-focused support.
Talk to a Local IT Expert → Or call 954-780-7159Sources:
Binance incident report
(November 3, 2026),
FBI alert on the Binance attack
(October 31, 2026),
Reuters reporting, and
BBC News. Dollar figures and the
timeline are as stated by Binance; the North Korea attribution is the FBI’s.