{"id":9932,"date":"2026-11-04T05:59:27","date_gmt":"2026-11-04T05:59:27","guid":{"rendered":"https:\/\/silvybrand.com\/?p=9932"},"modified":"2026-11-04T05:59:27","modified_gmt":"2026-11-04T05:59:27","slug":"binance-cyrpto-theft-explained","status":"publish","type":"post","link":"https:\/\/silvybrand.com\/?p=9932","title":{"rendered":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist"},"content":{"rendered":"


\n<\/p>\n

\n

The largest crypto theft to date<\/a> was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance<\/a>. A postmortem from the company says the process started in June with one developer downloading a tampered installer apparently spread by a malicious Google ad, exposing details about the engineers and how they work. Then, in September, another engineer was targeted by someone pretending to be interested in hiring them; that person set up a series of calls and multiple rounds of interviews, shared social media pages to build trust, and eventually prompted them to download a fake interview assignment that was actually malware.<\/p>\n<\/div>\n

\n

Binance claims that its security teams did detect the first installation of malware in June, and replaced the worker\u2019s device, but that its security tools didn\u2019t detect the second attack that deleted the pyenv executable and replaced it with a malicious version that gave them backdoor access:<\/p>\n<\/div>\n

\n
\n

The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server. The 0-day malware was not detected by the endpoint security protection tools at the time. The attacker also took steps to conceal the malicious activity and remove traces of the compromise, making detection and subsequent investigation more challenging.<\/p>\n<\/blockquote>\n<\/div>\n

\n

By October 20th, the story goes, the attackers, whom the FBI has identified as a North Korean unit dubbed \u201cTraderTraitor,\u201d<\/a> used Binance\u2019s own internal AI tool to gain control over wallets for the first engineer compromised in June, as well as a third employee, before logging into the third employee\u2019s computer on October 29th and launching their attack.<\/p>\n<\/div>\n

\n

The postmortem also goes into why Binance wasn\u2019t able to stop the transactions that occurred nearly two hours after the first unauthorized transfers, saying that \u201cBecause the hot wallet used Multi-Party Computation (MPC), there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations.\u201d Binance says that it has prevented 57 suspected North Korea-linked cyber threat cases, and CEO Richard Teng writes<\/a> that no user is bearing the loss, with about $2.85 billion in stolen assets frozen or intercepted: \u201cAt this moment, 98% of impacted tokens had been replenished; we\u2019re completing the remaining 2%. Withdrawals have broadly resumed.\u201d<\/p>\n<\/div>\n

\n

What\u2019s less clear is why this particular attack worked \u2014 the danger of job interviews that ask people to download and execute code on machines with access to employer material has been warned about for years, and there\u2019s little detail on the \u201cinternal AI tool\u201d that was used by the attackers and why it was able to help them in the first place.<\/p>\n<\/div>\n


\n
Source link <\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The largest crypto theft to date was pulled off by combining some well-known hacking techniques over the course of a few months, according to Binance. A postmortem from the company says the process started in June with one developer downloading a tampered installer apparently spread by a malicious Google ad, exposing details about the engineers […]<\/p>\n","protected":false},"author":1,"featured_media":9933,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[709,46,34],"class_list":["post-9932","post","type-post","status-publish","format-standard","has-post-thumbnail","category-gadgets","tag-crypto","tag-news","tag-tech"],"yoast_head":"\nBinance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog<\/title>\n<meta name=\"description\" content=\"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/silvybrand.com\/?p=9932\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog\" \/>\n<meta property=\"og:description\" content=\"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/silvybrand.com\/?p=9932\" \/>\n<meta property=\"og:site_name\" content=\"Silvybrand Lifestyle Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-04T05:59:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"624\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"SILVYBRAND\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"SILVYBRAND\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932\"},\"author\":{\"name\":\"SILVYBRAND\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/person\\\/8bdc6818a5b6ef5b9745e468818e37f3\"},\"headline\":\"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist\",\"datePublished\":\"2026-11-04T05:59:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932\"},\"wordCount\":474,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/acastro_STK018__02.jpg\",\"keywords\":[\"crypto\",\"News\",\"Tech\"],\"articleSection\":[\"Gadgets\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/silvybrand.com\\\/?p=9932#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932\",\"name\":\"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/acastro_STK018__02.jpg\",\"datePublished\":\"2026-11-04T05:59:27+00:00\",\"description\":\"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/silvybrand.com\\\/?p=9932\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#primaryimage\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/acastro_STK018__02.jpg\",\"contentUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/acastro_STK018__02.jpg\",\"width\":1200,\"height\":624},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/?p=9932#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/silvybrand.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#website\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/\",\"name\":\"Silvybrand Lifestyle Blog\",\"description\":\"Your daily dose of lifestyle, fashion, travel, beauty, and inspiration \u2014 living boldly, stylishly, and confidently.\",\"publisher\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/silvybrand.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#organization\",\"name\":\"Silvybrand Lifestyle Blog\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SILVYBRAND-LOGO.jpg\",\"contentUrl\":\"https:\\\/\\\/silvybrand.com\\\/wp-content\\\/uploads\\\/2026\\\/05\\\/SILVYBRAND-LOGO.jpg\",\"width\":1115,\"height\":522,\"caption\":\"Silvybrand Lifestyle Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/silvybrand.com\\\/#\\\/schema\\\/person\\\/8bdc6818a5b6ef5b9745e468818e37f3\",\"name\":\"SILVYBRAND\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g\",\"caption\":\"SILVYBRAND\"},\"sameAs\":[\"https:\\\/\\\/silvybrand.com\"],\"url\":\"https:\\\/\\\/silvybrand.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog","description":"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/silvybrand.com\/?p=9932","og_locale":"en_US","og_type":"article","og_title":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog","og_description":"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.","og_url":"https:\/\/silvybrand.com\/?p=9932","og_site_name":"Silvybrand Lifestyle Blog","article_published_time":"2026-11-04T05:59:27+00:00","og_image":[{"width":1200,"height":624,"url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg","type":"image\/jpeg"}],"author":"SILVYBRAND","twitter_card":"summary_large_image","twitter_misc":{"Written by":"SILVYBRAND","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/silvybrand.com\/?p=9932#article","isPartOf":{"@id":"https:\/\/silvybrand.com\/?p=9932"},"author":{"name":"SILVYBRAND","@id":"https:\/\/silvybrand.com\/#\/schema\/person\/8bdc6818a5b6ef5b9745e468818e37f3"},"headline":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist","datePublished":"2026-11-04T05:59:27+00:00","mainEntityOfPage":{"@id":"https:\/\/silvybrand.com\/?p=9932"},"wordCount":474,"commentCount":0,"publisher":{"@id":"https:\/\/silvybrand.com\/#organization"},"image":{"@id":"https:\/\/silvybrand.com\/?p=9932#primaryimage"},"thumbnailUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg","keywords":["crypto","News","Tech"],"articleSection":["Gadgets"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/silvybrand.com\/?p=9932#respond"]}]},{"@type":"WebPage","@id":"https:\/\/silvybrand.com\/?p=9932","url":"https:\/\/silvybrand.com\/?p=9932","name":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist - Silvybrand Lifestyle Blog","isPartOf":{"@id":"https:\/\/silvybrand.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/silvybrand.com\/?p=9932#primaryimage"},"image":{"@id":"https:\/\/silvybrand.com\/?p=9932#primaryimage"},"thumbnailUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg","datePublished":"2026-11-04T05:59:27+00:00","description":"The $6.3 billion crypto theft from Binance used malware served by a search ad, fake job interviews, and its own AI tool.","breadcrumb":{"@id":"https:\/\/silvybrand.com\/?p=9932#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/silvybrand.com\/?p=9932"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/silvybrand.com\/?p=9932#primaryimage","url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg","contentUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/11\/acastro_STK018__02.jpg","width":1200,"height":624},{"@type":"BreadcrumbList","@id":"https:\/\/silvybrand.com\/?p=9932#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/silvybrand.com\/"},{"@type":"ListItem","position":2,"name":"Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist"}]},{"@type":"WebSite","@id":"https:\/\/silvybrand.com\/#website","url":"https:\/\/silvybrand.com\/","name":"Silvybrand Lifestyle Blog","description":"Your daily dose of lifestyle, fashion, travel, beauty, and inspiration \u2014 living boldly, stylishly, and confidently.","publisher":{"@id":"https:\/\/silvybrand.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/silvybrand.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/silvybrand.com\/#organization","name":"Silvybrand Lifestyle Blog","url":"https:\/\/silvybrand.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/silvybrand.com\/#\/schema\/logo\/image\/","url":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/05\/SILVYBRAND-LOGO.jpg","contentUrl":"https:\/\/silvybrand.com\/wp-content\/uploads\/2026\/05\/SILVYBRAND-LOGO.jpg","width":1115,"height":522,"caption":"Silvybrand Lifestyle Blog"},"image":{"@id":"https:\/\/silvybrand.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/silvybrand.com\/#\/schema\/person\/8bdc6818a5b6ef5b9745e468818e37f3","name":"SILVYBRAND","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e7db54afd7d090e59e1a481fd3e6812d467eb2a3b81e7a3092023acfc59a496b?s=96&d=mm&r=g","caption":"SILVYBRAND"},"sameAs":["https:\/\/silvybrand.com"],"url":"https:\/\/silvybrand.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts\/9932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9932"}],"version-history":[{"count":0,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/posts\/9932\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=\/wp\/v2\/media\/9933"}],"wp:attachment":[{"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/silvybrand.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}