Hackers managed to pull off the largest crypto theft to date by combining fake job interviews, malicious Google ads, and an internal AI tool over several months, according to The Verge reporting on a Binance postmortem released on November 4, 2026.
Key takeaways
- The attack began in June when a developer downloaded a tampered installer from a malicious Google ad.
- In September, another engineer received a fake job interview invitation containing malware.
- Attackers used an internal AI tool by October 20th to gain control over employee wallets.
- Binance CEO Richard Teng stated that no user is bearing the loss and 98 percent of impacted tokens have been replenished.
How did the Binance heist happen?
The Verge reports that the multi-stage operation kicked off in June when an engineer downloaded a tampered installer spread by a malicious Google ad. Security teams at Binance spotted this first installation and swapped out the worker device. However, a second attack struck in September when a different engineer faced targeting from someone posing as a hiring manager. This person arranged multiple rounds of calls, built trust via social media pages, and ultimately persuaded the engineer to download a fake interview assignment packed with malware.
This zero-day malware bypassed endpoint security protection tools by deleting the pyenv executable and replacing it with a malicious version that established a backdoor. By October 20th, the attackers used Binance's own internal AI tool to take control of wallets belonging to the first engineer and a third employee. The intruders then logged into that third employee computer on October 29th to launch the final attack.
Why cryptocurrency theft recovery took time
The Verge notes that unauthorized transfers happened nearly two hours before transactions could be stopped. Binance explained that because the hot wallet relied on Multi-Party Computation, no single private key existed to immediately revoke the malicious EIP-7702 authorizations. The FBI identified the attackers as a North Korean unit named TraderTraitor. Binance has stopped 57 suspected North Korea-linked cyber threat cases overall.
What it means for users
CEO Richard Teng shared that withdrawals have broadly resumed after about $2.85 billion in stolen assets were frozen or intercepted. Users are not bearing the loss, as 98 percent of impacted tokens have been replenished and work is underway to complete the remaining 2 percent. Questions remain regarding why this attack succeeded despite long-standing warnings about interview code downloads and how the internal AI tool assisted the hackers.
Frequently asked questions
The incident began in June with a developer downloading a tampered installer from a malicious Google ad that exposed engineer details.
The FBI identified the responsible attackers as a North Korean unit known under the name TraderTraitor.
Hackers used Binance's own internal AI tool to gain control over wallets belonging to the first and third compromised employees.
No user is bearing the loss, according to CEO Richard Teng, who noted that 98 percent of impacted tokens have been replenished.
Because the hot wallet used Multi-Party Computation, there was no single private key available to immediately revoke the malicious authorizations.
Based on reporting by The Verge. Read the original article
