Fake Job Interviews and a Tampered Software Installer: How Attackers Stole $6.43 Billion from Binance

Binance has said the theft of $6.43 billion in assets was not a single breach or a simple phishing incident. The company described a "sophisticated, multi-stage campaign" that combined fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method.

The first stage began in June 2026, when an engineer on the Wallet DevOps team searched online for a popular AI tool. He downloaded a trojanized Homebrew installer, a tampered version of a legitimate software installer. Binance said it detected the attack and rotated all related credentials as a precaution. However, information about the engineer's role and his colleagues on the wallet infrastructure team was exposed to the attacker.

The second stage came in September 2026. The attacker contacted another engineer through a legitimate job-hunting platform, posing as a Project Director. The engineer was taken through two interviews: the first with a supposed HR representative, who shared a social media account full of personal photos and videos to build trust, and the second with someone claiming to be the CEO of a non-existent company, held on a popular chat app. Near the end, the engineer was told to download an "assignment" onto his work computer. It contained a malicious code repository that ran harmful code during setup and started a series of unauthorised activities.