How a fake job interview and an internal AI tool were used in the $6.3 billion Binance theft?
In June, a Binance engineer searched for an AI tool to write code, found one via a search engine, and installed it from a modified version of the Homebrew program. Binance says preparation for the attack began in June, and that this download was among the first steps in a chain that ended, according to estimates reported by The National, with a loss of roughly $6.3 billion last Friday, the largest recorded cryptocurrency theft, surpassing the $1.5 billion stolen from Byte in February 2025.
How did the chain start?This is what Binance posted on Tuesday. The attackers used a compromised computer belonging to a single engineer, then employed an AI tool to take control of two other engineers' wallets, and that was the launch point of the attack on October 20. The company listed the intrusion methods: social engineering through fake recruitment interviews, malware installation, compromised internal AI tools, engineers' device breaches, and an advanced transaction-authorization technique. The company did not name the programming tool or the search engine.
Where did the fake interview come from?By September, the social engineering had reached another engineer via a legitimate recruitment platform. Someone impersonated a project manager and asked the engineer to download a “task” to assess their skills, which contained malicious code. This means the attackers did not knock on the company’s technical doors but entered through the engineer seeking an opportunity, a door not protected by the company’s walls.
Who is the accused?Binance did not name the perpetrating entity. However, the U.S. Federal Bureau of Investigation attributed the attack on Saturday to a group called TraderTraitor, describing it as a hacking unit sponsored by North Korea. It said its members were observed converting the stolen assets into ether, and it expects further money-laundering using related techniques. This characterization places the incident in the security-sovereignty domain rather than ordinary crime, given the reference to a state-linked unit. Apart from that, the group’s objectives and the fate of the funds were not disclosed in the source, so we do not speculate.
How did Binance respond?It rebuilt the compromised wallet system in a new environment, reconstructed the internal AI tools and access controls, replaced the affected devices, and revoked the credentials and keys associated with the engineers involved. It is working with law-enforcement agencies, blockchain-intelligence firms and industry partners to trace and freeze the affected assets. It plans independent security reviews with external experts, to invest more in AI security, and to establish a security-research fund, while keeping some measures confidential. The company had said it would absorb the losses rather than pass them on to customers, and it resumed withdrawals on Sunday.
And what is the lesson for our region?The source contains no Gulf or Arab dimension, and we do not want to invent one. Our reading of the incident is: any team in the region that equips its engineers with AI tools and scouts talent through recruitment platforms shares the same vulnerability. The internal tool is no longer a peripheral assistant but part of the attack surface, and it deserves access controls no less stringent than the wallet safeguards that protect it. An engineer job-seeker should treat any “assessment task” they receive as a untrusted file until proven otherwise.
The honest summary:What we know so far comes from Binance’s own narrative and the FBI statement as reported by the newspaper, not from an independent investigation, and the loss figures are estimates. The constant in the narrative is that the attack passed through an AI tool and a fake job offer, and that trust in the tools and opportunities was the weak point before the technology itself.