Binance has now explained how its $6.34 billion theft happened. Attackers posing as recruiters got one engineer to run their code, then used the company's AI tool to reach colleagues' computers, one of which held a permission that let them launch software inside the wallet system. The sequence of events is ordinary at every step except the last.
A job offer is when a stranger can ask an engineer to run their code
A person calling himself a Project Director contacted a Binance software engineer on a real job-hunting platform. The engineer's profile listed his time at Binance. There was a video interview with a supposed HR representative, who shared a personal social media account to build trust. A second interview, in a chat app, was with the "CEO" of a company that does not exist. Then came the assignment: a code project to download and set up. Setting it up ran malware that swapped a developer tool on the laptop for a copy that ran the attackers' commands, and the company's security software did not notice.
The lure is not new. North Korea-linked fake recruiters have been targeting tech job seekers since at least 2023. It works because it fits how job hunting happens. A programmer asked to complete a test wants to impress, so he runs it on the best machine he owns, and that is usually the work laptop. His employer never sees the job platform, the interviews or the download.
Every company has people looking for other jobs at any moment, and an attacker needs only one of them. The cheap defence is boring: interview assignments get run on a machine that holds nothing of the employer's.
The AI tool joined the laptops together
On October 20 the attackers used the first engineer's laptop to work through the company's internal AI tool and take control of two other engineers' computers. Binance has not said how the tool allowed that. The structure is still familiar. An assistant that acts for many staff holds the permissions of all of them, so anyone who can talk to it borrows those permissions. It is a master key card in an office building: nobody needs to pick each lock if one stolen card opens every door.
For example, a mid-sized distributor could connect an assistant to the shared drive, the mailboxes and the accounting login, so staff can ask for last month's overdue invoices. If one person in the warehouse office opens a bad file, the attacker no longer has to break into the finance manager's PC. They ask the assistant, which can already reach it. The convenience and the risk come from the same design, so the assistant's reach should be drawn up the way you would for an employee with that much access.
A caught break-in is not an ended one
Binance's first warning came in June, when a wallet engineer downloaded a tampered installer for a popular AI coding tool that he had found through a search engine. The security team caught it, replaced his device and reset his credentials. By then the attackers knew his role and who else worked on the wallet system. The cleanup dealt with what had been taken, and the attackers had learned who to target. Four months later they were inside three engineers' computers.
After any break-in, the useful question is what the attacker now knows, as well as what they took. Binance has since rebuilt the wallet system and the AI tool in new environments, replaced devices and credentials, and added AI that watches for unusual behaviour. That is the right direction, since AI that learns what normal looks like on a network is well suited to spot a stolen login acting out of character.
The lesson for anyone adopting AI tools at work is about reach. Before a company connects an assistant to its people's computers, it should ask what an attacker could do with it from a single stolen laptop. If the answer is "reach everyone", the tool needs narrower access, not more trust.