Binance details fake interviews and developer-tool trap in $6.3 billion crypto theft

Teng said attackers lured one engineer into installing a fake developer tool in June. According to a Binance security report described by CNBC, a Wallet DevOps engineer downloaded a tampered Homebrew installation. Binance detected suspicious activity, replaced the device and rotated credentials, the report said, but the engineer’s role and related colleagues on the wallet infrastructure team had already been exposed.

In September, Teng said, attackers posed as recruiters and interviewed another engineer. A coding exercise contained hidden malware. He said the attackers then moved through internal AI tools and gained access to the system that authorized wallet transactions.

As of November 3, Teng said Binance had replenished 98% of $6.34 billion in affected assets and was still buying less-liquid assets. Replenishing assets is distinct from recovering stolen funds. He also said Binance had rebuilt the affected wallet system and internal AI tool, replaced compromised devices, retired associated credentials and tokens, and expanded employee-device scans. An independent expert review was planned, not completed. CNBC reported that Teng did not himself attribute the attack to North Korea, though he acknowledged an FBI link to hackers associated with TraderTraitor.