Binance traces its hack through a fake job interview

Binance’s initial report, published on 3 November, says a malicious recruitment assignment and a compromised internal AI tool helped attackers reach its wallet systems before the 29 October theft. The investigation remains open.

The new information concerns the route into the exchange, rather than another estimate of the loss. Binance says an engineer downloaded a malicious coding assignment during a bogus recruitment process in September. Attackers later used that compromised computer and an internal AI tool to reach other engineers’ machines and obtain deployment credentials.

According to the exchange, the attackers then accessed wallet-signing operations. It also says malicious on-chain authorisations allowed asset movements to continue outside normal withdrawal infrastructure. That explains why switching off withdrawals was insufficient to stop every transfer: the additional permissions had to be revoked.

Binance reports rebuilding affected systems, replacing devices and retiring compromised credentials. It says it will absorb the financial impact and is engaging independent security experts. Those are company statements; the initial findings are not a completed independent review. Reuters separately reported the fake-interview route on 3 November.

For readers, the useful distinction is between a convincing conversation and a trustworthy software download. A live interview can still lead to a malicious assignment. The report also illustrates why an emergency stop needs to account for permissions that survive the service being switched off. Our promise watch stays open while the fuller investigation continues.