Binance says fake job interview led to $6.3 billion crypto heist

What it is

Binance's incident report on the 29 October 2026 theft of about $6.34 billion in digital assets, as relayed by BleepingComputer on 3 November 2026. The FBI attributed the attack to TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). The page adds the intrusion timeline, the exact file manipulation on the macOS host, and recovery figures.

How it works

Contact began in September 2026 on a legitimate job-hunting platform. The attacker posed as a Project Director at a fictitious company and targeted a software engineer whose profile listed Binance experience.

Two interviews followed. The first was a live video call with a fake HR representative, who shared a social media account with personal photos and videos to build trust. The second was held in a popular chat application with a person claiming to be the CEO. There the engineer was told to download a coding assignment from an online code repository.

Running the assignment installed previously unseen custom malware. Binance says endpoint security did not detect it and that the attacker removed traces of the activity. The script then did the following in the macOS Homebrew installation directory:

1. Created a replacement executable named pyenv_.
2. Deleted the legitimate pyenv executable.
3. Renamed pyenv_ to pyenv and modified its symbolic link.
4. Used it to spawn a Z shell (zsh) process that ran commands from an attacker-controlled server.

By 20 October the attackers had used the engineer's machine and an internal AI tool to compromise two wallet-infrastructure employees, obtaining credentials and a container deployment token. On 29 October they used those credentials to deploy a malicious script and reach the wallet signing service, moving assets across multiple blockchains. They also abused Ethereum's EIP-7702 authorization mechanism to keep stealing after withdrawals were suspended.

What to do

The page gives no commands or detection rules. Its stated indicators point to these checks:

• Verify the integrity of developer tool executables in the Homebrew directory, especially pyenv, and look for a stray pyenv_ file or a changed symlink.
• Treat a coding assignment from a recruiter as untrusted code.
• Review which internal AI tools can reach credentials and deployment tokens, since that was the pivot path.

Binance's own response was to rebuild affected systems, replace compromised devices and revoke stolen credentials.

Caveats

• Binance has not tied the intrusion to a named campaign. BleepingComputer notes it closely resembles Contagious Interview and Operation Dream Job.
• As of 3 November 2026, about $2.85 billion had been frozen or intercepted. 98% of impacted token assets had been replenished as of 31 October.
• The investigation is ongoing, with independent security firms reviewing the findings.
• The page does not describe how the internal AI tool was abused or how the EIP-7702 abuse worked.