# Binance says a fake job interview and an internal AI tool led attackers to its wallet signing service

Source: https://startwithidentity.com/blog/2026-11-03-binance-says-fake-job-interview-and-internal-ai-tool-led-to-wallet-signing-service/
Last updated: 2026-11-03
License: content by Start with Identity. Cite the source URL.

---

Binance published initial findings on November 3 for the October 29 theft of about $6.34 billion. In September a software engineer was approached on a job-hunting platform by a fake recruiter, and a second-round coding "assignment" carried malware that replaced a legitimate pyenv component and evaded endpoint tools. On October 20 the attacker used that computer and an internal AI tool to take control of two engineers on the wallet infrastructure team, and found a container deployment permission token on one of their machines. On October 29 the attacker logged into the third engineer's computer, used the second engineer's credentials to deploy a container, and ran a script that reached the wallet signing service. It also abused EIP-7702 delegations, which kept working after withdrawals were suspended. About $2.85 billion has been frozen or intercepted.

## Why it matters

Our [first post](https://startwithidentity.com/blog/2026-10-30-binance-ties-6-3-billion-theft-to-a-compromised-devops-engineer-laptop/) quoted Binance saying the attacker "did not simply use one engineer's permissions." The chain explains it: three engineers' machines, one standing deployment token on a laptop, and an internal AI tool that let one compromised machine reach others. Binance also says a Wallet DevOps engineer installed a tampered Homebrew package in June; it replaced the device and rotated credentials, but the team's roles remained exposed. Rotation does not undo an attacker learning whom to target next.

Keep deployment tokens for signing systems off engineer laptops, issue them [just in time](https://startwithidentity.com/glossary/jit-access/), and require a second approver for deploys that touch signing. Treat internal AI tools that can act across machines as [privileged access](https://startwithidentity.com/guides/architecture/implementing-privileged-access-management/). The FBI has attributed the theft to North Korea's TraderTraitor. More cases are in our [breach incident database](https://startwithidentity.com/breaches/incidents/).

Source: [Binance](https://www.binance.com/en/blog/community/3229153443759566763)