It Turns Out Binance’s $6 Billion Hack Happened Because Its Employees Were Vibe Coding

Nearly $6.3 billion was stolen from the crypto platform Binance in a hack that is now revealed to have been facilitated by employees engaging in "vibe coding." Binance's investigation detailed an elaborate scheme that unfolded over months, involving fraudulent job interviews, phishing, and the exploitation of an AI tool. The attack began in June when an employee installed a tampered version of Homebrew after clicking a malicious ad.

This allowed the hackers to gain access to the employee's device and the wallet developer team. Subsequently, a hacker posing as a project director contacted another software engineer via a legitimate job-hunting platform, offering an interview with a fake company. The fraudsters gained the engineer's trust by sharing a social media account with personal photos and videos, a more advanced tactic than previously seen.

The interview was conducted over text, with the engineer asked to download a malicious "assignment" that replaced a real development tool with a malicious version capable of communicating with the hackers. In October, the compromised employee machine was used to leverage Binance's internal AI tool and gain control of a third wallet developer's computer.

The hackers then stole credentials from the first employee to execute a malicious script that siphoned 233.46 million XRP from five wallets and plundered other forms of cryptocurrency. While the culprits remain unidentified, the FBI initially blamed a North Korean hacking group, which Pyongyang has denied. Binance had previously thwarted 57 suspected North Korea-linked cyber threats, but this breach exposed its vulnerabilities.