The Incident
Binance has released a postmortem describing how attackers stole roughly $6.3 billion in digital assets through two linked operations separated by several months. The first step occurred in June when a developer installed software from a malicious Google advertisement. That compromise supplied details about internal engineering practices and staff. In September the same group used that information to run a sustained social-engineering campaign against a second engineer, impersonating recruiters and guiding the target through multiple interview stages until the engineer executed further malicious code.
The combined access allowed the attackers to reach an internal AI tool with sufficient privileges to move funds out of the exchange. Binance presents the event as the largest recorded crypto theft and attributes its scale to the extended timeline rather than any single zero-day exploit.
Context
Prior to these events, Binance had treated routine developer workstation security and external hiring communications as largely separate concerns. The June compromise revealed specific information about how engineers interact with internal systems and who participates in those workflows. That reconnaissance directly informed the September campaign, which relied on credible-seeming interview materials and fabricated social profiles to lower the second engineer’s suspicion.
The two incidents together illustrate how an initial foothold on one machine can be converted into targeted leverage against another employee months later. Binance notes that the attackers reused established techniques—malicious installers and interview-based social engineering—executed with patience rather than novel technical breakthroughs.
Timeline and Method
The first vector appeared in June. One developer downloaded an installer distributed through a poisoned Google ad. Once running, the software provided the attackers with visibility into engineering tools, team structures, and day-to-day processes. No further immediate action was taken on that machine.
In September the group contacted a different engineer, presenting themselves as a hiring team. They conducted multiple interview rounds, supplied fabricated social-media accounts to establish legitimacy, and eventually delivered what was described as an interview assignment contained in a document. When the engineer opened the file, additional malicious code executed on that workstation.
The second compromise granted access to an internal AI tool already granted broad privileges within the exchange infrastructure. Binance states that these existing permissions proved adequate for the attackers to initiate and complete the asset transfers. The postmortem does not detail the exact commands issued through the tool or the precise sequence of on-chain movements.
Engadget reports the total loss as $6.34 billion, a minor difference from the $6.3 billion figure cited by The Verge. Both accounts trace the outcome to the same two-stage approach: initial reconnaissance followed by a convincing impersonation that exploited normal hiring activity.
Why it matters
The case demonstrates that developer endpoints and hiring workflows remain high-value targets even at large crypto platforms. A single tampered installer created the reconnaissance needed for a credible impersonation months later, turning ordinary interview activity into an entry point. Organizations that maintain separate security perimeters around hiring conversations and internal tooling must now treat any information overlap between the two as a direct exposure path.
The final use of an internal AI tool as the extraction mechanism further narrows the set of systems that require isolation from any workstation reachable through social engineering. Defenses focused solely on novel exploits will miss attacks that succeed through sustained, low-sophistication operations executed over time.
---
Sources:
No comments yet