Binance's Post-Mortem Is Out. The $6.3 Billion Hack Started With a Job Offer.

In September, a software engineer at Binance received a seemingly legitimate job offer via a job-hunting website. The sender, claiming to be a project director, conducted a series of interviews, including a live video session, before asking the engineer to download a coding assignment to his work computer. Within weeks, approximately $6.3 billion had been siphoned from Binance's hot wallets, marking the largest crypto theft in history.

Binance published a post-mortem report on 3 November, revealing that the attack had its origins in June, when the attacker utilized a tampered Homebrew installation to install a malicious AI coding tool. This allowed the attacker to gain knowledge of the team members and the infrastructure of Binance's wallet systems.

In September, the attacker sent a deceptive job interview invitation to another engineer, Engineer B, who was part of the wallet infrastructure team. The attacker's message was far more sophisticated than any social engineering attempt Binance had encountered previously, with 57 suspected state-sponsored attacks detected and blocked in 2026 alone.

The malicious coding assignment executed a zero-day exploit, deleting a commonly used tool for managing Python versions and replacing it with a doctored version. This provided the attacker with a foothold on the engineer's computer, which was then used to gain control over two more engineers' machines. On 20 October, the attacker exploited Engineer B's machine and an internal AI tool to infiltrate two additional engineers' computers, ultimately obtaining permission to deploy containers.

Two days later, between 17:15 and 19:56 UTC, the attacker gained access to Engineer C's computer, used Engineer A's stolen credentials, and deployed a malicious script. This gave the attacker access to Binance's internal wallet-signing service, which authorized transactions. Within nine minutes, a transfer of 233.46 million XRP was sent from five of Binance's hot wallets to the attacker's address.

The attack resulted in significant financial losses for Binance, with $2.85 billion frozen or intercepted and 98% of affected tokens replenished by 31 October. The exchange claimed it had rebuilt the affected wallet system, internal AI tool, and tightened wallet-service risk controls, but emphasized the importance of rehearsing emergency response procedures to prevent future incidents.