Binance details how $6.34B was stolen: wallet engineer infected via fake take-home job assignment
mfckr_eth · x · 2026-11-04
Binance has published the attack chain behind the $6.34 billion theft:
- June: an engineer searching for a popular AI coding tool clicked a search result and installed a tampered Homebrew. Binance caught it, replaced the laptop and rotated credentials — but the attackers now knew who worked on the wallet team.
- September: another engineer received a job offer via a real job-hunting site. A first-round video interview with "HR" included shared social media, personal photos and videos to build trust; the second round was with the "CEO" of a nonexistent company. At the end, he was asked to download a take-home "assignment" onto his work laptop.
- The assignment quietly swapped out a critical component, leading to the theft.
Commentator mfckreth notes the engineer violated the first rule of wallet security: never install untrusted files on a work machine — one of the oldest social engineering tricks in the book.
More from coding & agent
- Orgo, a YC-backed platform giving AI agents their own cloud desktops, claims 1,000+ teams — Scobleizer · 2026-11-04
- Founder: Vibe-coded a PMF-successful product, then hired pro devs to fix the mess — sujingshen · 2026-11-04
- One prompt to audit cross-region traffic: dev cut trans-Atlantic latency by moving a service — DanielLockyer · 2026-11-04
- Agent silently completed only a quarter of a 200-module build and stalled waiting for confirmation — Promptmethus · 2026-11-04
- ChatGPT Agent mode can scan LinkedIn and Indeed and build a tailored job-application spreadsheet — nikola_mr64990 · 2026-11-04
- Blogger auto-applied to 500 jobs via ChatGPT and got 12 interview calls in 24 hours — nikola_mr64990 · 2026-11-04