Binance Lost $6.34 Billion to a Fake Job Interview. The Weak Link Was a Developer Laptop.

Binance lost $6.34 billion on Oct. 29. The way in wasn't a broken key or a wallet exploit. It was a job interview.

The exchange's incident report, published Tuesday, describes five months of setup. Back in June, a wallet DevOps engineer searched for an AI coding tool and grabbed a tampered Homebrew installer. Security caught the anomaly, replaced the machine and rotated credentials. But the attacker walked off with something more valuable than malware: the names and roles on the wallet infrastructure team.

Then came September. A second engineer got contacted on a legitimate job platform by someone posing as a project director. Two video interviews followed, including one with a supposed HR rep who shared a personal social account to build trust. The assignment at the end was a code repo. It replaced a legitimate pyenv component and opened a channel to an attacker server. Binance's endpoint tools never flagged it.

On Oct. 20 the attackers used that machine and an internal AI tool to reach two more wallet engineers. Nine days later they drained 233.46 million XRP, roughly 970,500 SOL, 44.2 million OP and 18,270 BTC from hot wallets. That bitcoin alone is about 40 days of network-wide issuance, gone in minutes. They also invoked Ethereum's EIP-7702 to hand a contract partial control of a hot wallet. Since the wallet ran on multi-party computation, there was no single key to revoke. The final transfer, 2,961.9 ETH, settled at 23:56 UTC. Binance cleared the delegation at 00:10 UTC.

Binance says it froze or intercepted $2.85 billion and refilled 98% of affected tokens from its own funds. Customers still pulled $10.97 billion in the 46 hours after withdrawals reopened, with $5.28 billion net out. Deposits finally beat withdrawals by 03:00 UTC. CFTC Chairman Michael Selig pointed to the breach as proof offshore venues need a federal registration path, and the agency cleared equity perpetual futures for U.S. regulated venues the same day.

Here's what should bug anyone running infrastructure: the chain held up fine. A developer laptop and a hiring pipeline didn't. Follow the hashrate if you want, but the risk that actually costs you money walks in through a recruiter who never existed.