The problem: Attackers drained $6.34 billion from Binance hot wallets in under four hours after infiltrating internal systems.
The fix:
Watch out: State-sponsored groups actively target crypto engineers using fake interviews and tampered developer packages to bypass antivirus tools.
THE BIGGEST CRYPTO THEFT EVER STARTED WITH A JOB OFFER.
THE BIGGEST CRYPTO THEFT EVER STARTED WITH A JOB OFFER.Been following this since the news broke — Binance dropped their report Nov 3. The full picture: $6.34 billion gone in under four hours.
The front
October 29, 20:05–23:56 UTC: attackers drained Binance’s hot wallets (the internet-connected ones) — XRP, SOL, OP, BTC, a pile of ETH, about 54% stablecoins (USDT and USDC).
| Where the money sits now (Nov 6) | Amount |
|---|---|
| Frozen or intercepted | ~$2.85 billion |
| Still in theft-linked addresses | ~$3.11 billion |
| Already converted into BTC | ~$124 million |
Binance says no private keys leaked; it covered the loss itself — 98% replenished by Oct 31, withdrawals back in phases from Nov 1.
What it means for you
Honestly, most of the lessons here are for us, not Binance:
- Recruiter code never runs on your real machine — a coding exercise goes in a VM or throwaway laptop. A recruiter who insists on your real machine ends the interview there.
- Install tools by typing the project’s address yourself — that Homebrew copy came from a paid ad atop search results. Sponsored links are the attack now.
- Your coins are only as safe as the exchange’s internal security. Binance could eat $6.3B; few exchanges carry a cushion that deep. Serious money on one platform is the risk you’re taking.
- The money isn’t “gone” — it’s moving in plain sight. Elliptic counted 20,000+ wallets, 16 chains, 65,000+ laundering transactions; almost none cashed out yet.
Who did it
The FBI attributed it Oct 31 to TraderTraitor, a North Korea-linked group.
🔎 The full story — every step, the technical layer, the attribution
The timeline, in detail
- June 2026 — a DevOps engineer on the wallet team installs a tampered Homebrew copy from a paid ad. The fake installer carries a password stealer. Binance’s team catches it, replaces the machine, resets the credentials — the attackers already know who works on the wallet team, and that’s the real prize.
- September 2026 — a second wallet engineer is approached on a job-search platform (execs told reporters it was LinkedIn; the report leaves it unnamed) by someone posing as a project director at a company that didn’t exist. Two interviews: a live video call with a fake HR manager showing off a social profile full of personal photos, then a self-styled CEO who moves the chat to a messaging app and asks him to download a coding “assignment” and run it on his work computer.
- October 20 — using that second engineer’s machine and an internal AI tool, the attackers take over two more systems, including the first engineer from June and a third wallet engineer. How the AI tool was abused is one of the big open questions the report leaves open.
- October 29 — a session opens on the third engineer’s machine, a container launches using credentials taken from the first engineer, and a malicious script runs against the internal service that signs wallet transactions. From there it’s just outflow.
How the drain actually worked
-
The malware was brand new. Binance says it had never been seen before (a 0-day) and corporate antivirus didn’t recognize it. It replaced a legit component of a developer tool (pyenv, the Python version manager) and opened a channel to an attacker-controlled server, then wiped its tracks.
-
The Ethereum part is nasty. Using EIP-7702 — a mechanism that lets an address delegate execution to a contract — the attackers gave a contract they controlled partial rights over a hot wallet. Those authorizations live on the blockchain, so suspending withdrawals did nothing. And because the wallet was protected with MPC (the key split among several parties, nobody holding a whole one), Binance had no single key to cancel the delegation. It was only revoked shortly after midnight.
-
It was a chain, not one mistake. A deploy token sitting on a laptop opened the way to the service that moves billions. One engineer’s caution in front of one file should never have been the last line of defence.
Who did it — the full attribution
TraderTraitor is also known as Lazarus / Jade Sleet / APT38. Pyongyang denies it; Kim Yo Jong called it a “serious political provocation”. Binance says it detected and blocked 57 North Korea-linked threats in 2026 alone, including fake interviews and compromised software packages. The fake-recruiter trick itself is a known pattern (analysts call it Contagious Interview / Operation Dream Job). The report is Binance’s own preliminary one — independent security firms are still reviewing it, and the timeline could still change.
The market after
Around $12 billion in deposits left the exchange that week; BTC dipped below $78,000, a six-week low.
Sources: Binance’s preliminary incident report (Nov 3, 2026), FBI attribution (Oct 31), Elliptic’s fund tracking (Nov 6), plus SecurityWeek, Fortune, TechCrunch, Axios and BleepingComputer.
What do you guys think — is this the point where exchanges have to stop letting dev laptops anywhere near signing infrastructure, or is this just the cost of doing business at Binance’s scale? And has anyone here ever been approached by one of these fake recruiters? Curious how common it actually is.
!