Inside the $6.3B Binance heist: fake interviews, a poisoned Homebrew, and an abused internal AI

Binance lost about $6.3 billion on October 29, 2026 — the largest crypto theft on record. Its November 3 security report traces a four-month campaign built on fake job interviews, a trojanized Homebrew package, and abuse of Binance’s own internal AI tool.

Key points

• On October 29, 2026, attackers moved about $6.3 billion in crypto off Binance in roughly 20 minutes — the largest digital-asset theft on record (Reuters).
• The way in: starting in June, a wallet-infrastructure engineer was approached through a real job platform with fake interviews; during a “coding assignment” he downloaded a trojanized Homebrew package of an AI coding tool containing zero-day malware that evaded Binance’s security tooling.
• Four months of lateral movement followed: stolen credentials, abuse of Binance’s internal AI tool for reconnaissance, and eventually access to the wallet-signing service.
• Blockchain-intelligence firms attribute the attack to a North Korea-linked crew (Lazarus-affiliated); Binance’s November 3 security report says 98% of affected customer assets have been replenished.

A narrative write-up circulating on WhatsApp tells this story as “something you could film for Netflix”: an engineer types an AI coding tool’s name into a search engine and installs the first result — a Homebrew package the hackers had tampered with. The plot matches the official account almost line for line; the real event is colder than the story. This was not a single mistake but a four-month campaign that used a human as the entry point and AI tools as the stepping stones.

The four-month campaign

Per Binance’s November 3 security report and public statements from co-CEO Richard Teng, the campaign began in June 2026: the crew contacted a wallet-infrastructure (DevOps) engineer through a legitimate job platform and ran multiple rounds of interviews under a fake company identity. During the “coding assignment” stage, the engineer searched for an AI coding tool and landed on a trojanized Homebrew distribution carrying zero-day malware that evaded Binance’s security tools. BBC, The Guardian, The Washington Post, Wired and SecurityWeek all confirm this chain. Over the following four months the attackers moved laterally, harvested credentials and abused Binance’s internal AI tool for reconnaissance. On October 29 they acted: Reuters’ headline was “gone in 20 minutes” — about $6.3 billion moved off the exchange in roughly twenty minutes, the largest single crypto theft on record.

Why this path matters to every team

None of the three stages is novel; combined, they pierced the world’s largest exchange. Job-interview social engineering is an old play. Supply-chain poisoning — a tampered installer distributed through a package manager — is an old play. Abusing the target’s own internal AI tool for reconnaissance is the new variable: the poisoned engineer and the abused internal AI made every attacker step look like normal work. The direct lessons for engineering teams: when provisioning AI coding tools for privileged staff, whitelist installation sources; treat internal AI systems’ access logs as production-grade audit surfaces; and give wallet or key-signing services an approval chain that is independent of any engineer’s laptop.

Payback and attribution

Binance says 98% of affected customer assets have been replenished (some reporting puts the total targeted at up to ~$9 billion — the official report is the reference). Blockchain-intelligence firms attribute the attack to a North Korea-linked group (Lazarus-affiliated); that attribution is an assessment, and official communications use “linked.” Wired’s analysis stresses that the attackers used well-known tricks: no exotic techniques, only patience.

Summary

The number is not the lesson; the structure is. AI coding tools have become a fresh entry point for supply-chain poisoning, and internal AI systems a fresh reconnaissance surface — both are products of the last two years. Three minimal actions for individuals and teams: install AI tools only from official channels and verify package hashes; run “interview assignments” for privileged roles in isolated environments; and treat internal AI tools’ logs and permissions like production systems. Our write-up on cognitive surrender warned against outsourcing your judgment; this case adds a corollary — don’t let an attacker install your judgment tools either. Our cognitive surrender piece covers the other face of the same coin — chosen delegation versus lost custody.