Binance's $6.34 Billion Hack Is a Reminder That Phishing Still Works

A fake job interview, a poisoned software download, and compromised developer computers was the mix that allowed attackers to get access to Binance systems, ending in a $6.34 billion cryptocurrency theft.

You might not own any cryptocurrency, but the techniques described in Binance's incident report should sound familiar to anyone who uses a computer, which is partially the scary part. Nothing here is “new”.

According to Binance's initial investigation, the October 29, 2026 attack involved months of preparation, social engineering, malicious developer tools, and compromised internal AI tooling. The FBI attributes the theft to North Korea.

Binance is a cryptocurrency exchange, a platform where people buy, sell, trade, and store assets such as Bitcoin and Ethereum. Founded in 2017 by Changpeng Zhao (“CZ”) and Yi He. Centralized exchanges like Binance also hold cryptocurrency on customers' behalf to the tune of over $117 Billion , making them attractive targets for attackers.

Binance says it will absorb the financial impact rather than pass the losses to users.

The dollar amount is enormous. By far the largest crypto heist I could find, with the next closest being 1.5 Billion in 2025 and hard to really fathom. But the opening tricks were much more familiar: convince someone that a download is legitimate, build trust, and get them to run something they shouldn't.

The Job Interview Came With Malware

One of the more useful details in Binance's account concerns an engineer who approached the comany through a legitimate job-hunting platform.

The ‘applicant’ went through multiple interview rounds. An initial interviewer appeared on a live video call and shared a social media profile containing personal photos and videos to establish credibility. A later interview involved someone claiming to be the CEO of the prospective employee.

Near the end, the engineer was instructed to download a coding assignment onto a work computer. According to Binance, malicious code ran during the project's setup process.

That's the trap. You aren't necessarily being asked to open an obviously suspicious attachment. You're being asked to complete something that fits the situation. Developers expect coding assignments. Job applicants expect interviews. The attacker makes the dangerous action feel like the next reasonable step. This is called pretexting, a form of social engineering where an attacker creates a believable situation to persuade someone to do something unsafe.

A Software Search Was Another Opening

Binance also describes an earlier incident in which another engineer downloaded a tampered Homebrew installation while trying to install a popular AI coding tool found through a search engine.

Homebrewnot the official Homebrew project itself whihc is quite safe to use.

Binance says its security team detected that incident, replaced the computer, and rotated related credentials. However, the attackers had learned about the engineer's role and colleagues working on wallet infrastructure.

For home users, the lesson applies just as easily to a browser update, PDF converter, driver utility, or AI app. Appearing in search results doesn't make a download trustworthy; this has been true since the invention of search results. Verify the actual publisher and destination before downloading, especially when a page asks you to paste commands into a terminal.

How Compromised Computers Became a Multibillion-Dollar Problem

The report describes attackers using a compromised engineer's computer and an internal AI tool to reach additional engineers. They discovered a deployment token, a credential that permitted access to part of the company's infrastructure, and subsequently reached wallet-signing operations.

A signing service authorizes cryptocurrency transactions. Gaining access to that service allowed attackers to initiate transfers outside Binance's normal withdrawal process.

That distinction became important during containment. Binance says the attackers also established permissions on Ethereum that allowed further asset movements independently of its normal withdrawal systems. Suspending withdrawals did not automatically cancel those permissions. They had to be revoked separately.

You don't need to understand every blockchain detail to recognize the broader problem: shutting down the front door doesn't help much if someone has already opened the back way in.

Where AI Fits, and Where Vibe Coding Doesn't Belong

There are two AI connections in Binance's account: an engineer seeking an AI coding tool encountered a malicious download, and attackers later used a compromised internal AI tool as a stepping stone.

Neither establishes that AI-generated code caused the theft. The report does not demonstrate that someone vibe coded Binance's wallet infrastructure, and blaming that would go beyond the evidence.

But it does bring up a rule worth stating plainly: vibe coding should not be used to put software into production when it means accepting generated code you don't understand and shipping it because it appears to work.

Experiment with a personal project? Have fun. Put code in charge of customer data, deployment credentials, or financial transactions? Somebody needs to understand it, review its permissions, test its behavior, and take responsibility for it. AI assistance doesn't remove those obligations.

"It ran without an error" is a pretty low bar for software standing between an attacker and billions of dollars. Might wanna think about double-checking that first, right?

Old-Fashioned Phishing Still Pays

This wasn't merely one phishing message followed by an instant theft. Binance describes a coordinated campaign with several stages. But well-known social engineering tricks helped create the openings. It a way it feels like Binance is making an excuse like “whoa, these guys were good.” But in reality, it exposes that fact: Binance had multiple security flaws that should have been obvious.

I'm tempted to send Binance management a free copy of my phishing e-book. As a professional courtesy, naturally.

Final Note

Phishing doesn't have to involve a badly spelled email from a prince. It can arrive as a recruiter, an interview assignment, a software installation guide, or a helpful person telling you which tool you need.

The useful precautions are straightforward:

* Verify recruiters and employers through contact information you find independently.
* Treat requests to install interview software, run coding assignments, or paste commands as security decisions.
* Keep personal job hunting and untrusted projects away from work computers and accounts.
* Download software from verified sources rather than trusting a search ranking or advertisement.
* Use multifactor authentication, but remember that it doesn't make an infected computer or stolen access token harmless.

Jim McMahon Jim McMahon, aka Corporal Punishment, is the founder of MajorGeeks.com. He has spent decades testing software, troubleshooting Windows, and helping users cut through the nonsense. He loves real freeware, hates bloatware, and runs on caffeine, sarcasm, and questionable choices.

comments powered by Disqus