In September, a software engineer at Binance got a message on a legitimate job-hunting site. The sender called himself a project director. The engineer's profile mentioned his work at Binance.

Round one was a live video interview with an "HR representative," who shared a social media account full of personal photos and videos to build trust. Round two happened in a popular chat app, with a man claiming to be the CEO of a company that didn't exist. Near the end, he asked the engineer to download a short coding assignment.

He downloaded it to his work computer.

Within weeks, about $6.3 billion left Binance's hot wallets in the largest crypto theft on record.

Last week I wrote about how Binance lost that money without losing a single private key. At the time, Binance had only said the trouble "may involve a compromised DevOps engineer's laptop." On Tuesday, 3 November, it published its post-mortem. The laptop turns out to be the last chapter of a story that started in June.

It opens with a line you rarely see from a crypto exchange: "This should not have happened."

June: the attacker learns the team's names

It began with a search engine. A wallet DevOps engineer (the report calls him Engineer A) searched for a popular AI coding tool and installed it through what turned out to be a tampered Homebrew installation. Binance files it under supply-chain attack.

Binance's security team caught it. They flagged the anomaly, replaced his device and rotated his credentials, which is exactly what a good team should do.

It was still too late in one respect. The attacker now knew who Engineer A was, what he worked on, and who sat next to him on the wallet infrastructure team. The malware was gone; the map of people stayed.

September: the interview

That map explains why Engineer B got such a friendly message in September. Binance calls the approach more deceptive than any social engineering it had seen before. It also had plenty of company: the exchange says it detected and blocked 57 suspected state-sponsored attack attempts in 2026 alone, using fake job interviews, booby-trapped developer tools, poisoned browser extensions and fake video-call apps.

"We've identified dozens of other job interview compromises that have led to wallet compromises."

Tom McLouth, senior intelligence analyst at Chainalysis, speaking to The Hacker News

The "assignment" ran malicious code during setup. It deleted the real copy of pyenv, a common tool for managing Python versions, from the engineer's Homebrew folder, slipped a doctored copy into its place, and opened a line to a server the attacker controlled. According to the report, the malware was a zero-day, endpoint security didn't catch it at the time, and it scrubbed its own traces.

One laptop, one trusting moment, and the attacker had a foothold.

20 October: the AI tool becomes a stepping stone

For weeks, nothing visible happened. Then, on 20 October, the attacker used Engineer B's machine and an internal AI tool to gain control of two more engineers' computers, Engineer A's and Engineer C's.

On Engineer A's machine they found the prize: a token with permission to deploy containers.

Binance hasn't explained how its own AI tool let an outsider jump from one computer to another. That gap matters. Companies are rolling out internal AI assistants with wide access to code, tickets and machines, and this may be the first billion-dollar case of one being turned into a lateral-movement tool.

29 October: two hours and 41 minutes

Between 17:15 and 19:56 UTC, the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, deployed a container and ran a malicious script. That gave them Binance's internal wallet-signing service, the system that authorizes transactions.

Nine minutes later, at 20:05 UTC, five Binance hot wallets on the XRP Ledger sent 233.46 million XRP to the attacker. Solana, Optimism, Bitcoin and Ethereum followed.

Why hitting "pause" didn't stop the bleeding

This is the part that should worry every custody engineer.

Binance suspended withdrawals that night. Money kept leaving anyway. The attacker had used the signing service to approve 50 EIP-7702 authorizations, which gave an attacker-controlled contract execution rights over a hot wallet. Those rights lived on-chain. Binance's withdrawal switch had no say over them.

To cancel a delegation, the wallet has to sign a revocation. Binance's hot wallet used multi-party computation (MPC), which splits signing power across several parties so that no single stolen key can move funds. That same design meant no single key could cancel the delegation quickly either. Binance had to build a special revocation procedure on the spot.

The last unauthorized transfer, 2,961.9 ETH, finalized at 23:56 UTC; it had been broadcast earlier and sat pending. At 00:10 UTC on 30 October, Binance signed a new authorization that pointed the wallet's delegation at the zero address, which finally cleared it, just over four hours after the first coins moved.

The control built to stop theft slowed the cleanup. I don't think that argues against MPC. It argues for rehearsing the emergency path (revoke, rotate, freeze) before you ever need it.

What Binance says it has fixed

Binance says it has rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced devices, decommissioned the affected engineers' credentials and tokens, scanned every employee device, and tightened wallet-service risk controls. It's also bringing in independent security firms and setting up a research fund on AI security in blockchain systems. About $2.85 billion has been frozen or intercepted, and 98% of affected tokens were replenished by 31 October.

"We're also getting an independent expert to review everything that we have done."

Binance co-CEO Richard Teng, speaking to CNBC

Binance calls this an initial report and says some measures will stay private so attackers can't plan around them. Fair enough. Still, three questions are open: how the internal AI tool was abused, which AI coding product was impersonated in June, and why a container-deployment token was sitting on an engineer's laptop at all. Those are the answers other exchanges need most.

The interview is now part of the attack surface

The uncomfortable lesson is that the attacker spent months on people and only hours on systems. Engineer A did nothing reckless; he searched for a tool his whole industry uses. Engineer B did what thousands of developers do every week when they look for a new job.

"It should come as no surprise that employees are interviewing on company time."

Tyler Reguly, associate director of security R&D at Fortra, quoted by Help Net Security

So if you work anywhere near production, never open an interview assignment on a work machine. Use a throwaway virtual machine or a separate personal device, every time.

And if you run a security team, put "our engineers are job hunting" on your threat model. At Binance, that line was worth $6.3 billion.

This follows my earlier piece, Binance Lost $6.3 Billion to Its Own Signing Machine. Details come from Binance's post-mortem of 3 November 2026 and the reporting linked above.

Disclosure: I hold no position in Binance and have no affiliation with the company.