North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist

North Korean hackers used a fake job interview, a poisoned coding task, and a hijacked internal AI tool to reach Binance’s wallet systems. The FBI says the North Korean group it calls “TraderTraitor” stole more than $6 billion in digital assets on 29 October 2026. Binance puts the impacted value at about USD 6.34 billion.

Binance says this was a multi-stage campaign and not a simple phishing case. In June 2026, a wallet DevOps engineer searched online for an AI coding tool and installed a tampered Homebrew package.

Binance replaced the device and rotated credentials, but the attacker had already learned who worked on wallet infrastructure. A similar fake Homebrew ad pushed MacSync Stealer earlier this year, according to the SANS Internet Storm Center.

In September, a second engineer was approached on a job platform by a fake “Project Director.” Two interviews followed, one with a fake HR person and one with a fake CEO. The first included personal social media content to build trust. Near the end of the second, the engineer was told to download an “assignment” onto his work computer.

Malware and the AI Tool

The code ran during setup. It swapped a real pyenv file for a malicious copy, made a new symlink, and started a zsh shell. Binance says the zero-day malware slipped past endpoint tools and wiped its own traces.

On 20 October, the attacker used that computer and an internal AI tool to take over two more engineers. One of them held a container deployment token. Between 17:15 and 19:56 UTC on 29 October, the attacker logged on to the third engineer’s computer. Using the stolen token, they deployed a container and ran a malicious script.

This fits a pattern. Our earlier report on WaterPlum described fake recruiters infecting more than 30,000 devices. Our TraderTraitor Terraform story showed the same group using fake DevOps tests.

Using the wallet signing service, the attacker moved funds outside the normal withdrawal process. Between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP out. Later transfers included about 970,500 SOL, 44.2 million OP and 18,270 BTC.

The attacker then used Ethereum’s EIP-7702 feature. It lets an account hand some execution rights to a smart contract without revealing the private key. The attacker sent 50 signing transactions to match the wallet’s changing nonce, which is a transaction counter. One worked, and the wallet pointed to the attacker’s code.

Stopping withdrawals did not remove that delegation, because it lived on-chain. Binance’s wallet used Multi-Party Computation (MPC), so no single key could undo it quickly.

The team built a special procedure instead. At 00:10 UTC on 30 October, it cleared the delegation by authorizing the zero address. Researchers note this removes the attacker’s code but does not replace the signing key.

About USD 2.85 billion was frozen or intercepted. Binance says it will absorb the loss and that 98% of impacted tokens were replaced by 31 October, which users can check on its Proof of Reserves page.

According to reports, the funds came from the SAFU reserve, an insurance fund, and company money. The FBI says the actors are converting stolen funds mainly into Ethereum and expects more laundering through DeFi and swap services.

Binance rebuilt the wallet system and the AI tool, replaced devices, and removed engineers’ credentials. It also scanned all employee devices and added AI-based anomaly detection. An independent review is underway.

Treat job offers that ask you to run code on a work computer as a threat. Use separate devices for interviews. Limit what internal AI tools can reach. Keep deployment tokens off laptops.

Track changes to account permissions, not just transfers. Finally, plan to both revoke access and rotate keys during an incident, since they are separate steps.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist appeared first on Cyber Security News.