Binance incident report details $6.3B theft via TraderTraitor malware after fake job interview

The attack began in June with a supply chain compromise when Engineer A installed malicious Homebrew code. Security teams detected the initial payload, rotated credentials, and replaced the device, yet the incident exposed the engineer's role and colleagues on the wallet team. Three months later, a second engineer received contact via a legitimate job platform from actors posing as a project director, progressing through video interviews that built trust with shared personal media before delivering a malware-laced code repository during a chat-app session with a fake CEO.

Execution logs show the malware swapped a legitimate pyenv binary (3,344 B) with a 3,414 B malicious version, created symlinks, and spawned hidden processes that evaded endpoint detection. On October 20 the compromised host accessed an internal AI tool, exfiltrated Engineer A's container deployment token, and on October 29 used those credentials to deploy a container on Engineer C's machine that triggered the draining script. FBI attribution links the campaign to TraderTraitor, the Lazarus Group subunit previously tied to Ronin and Atomic Wallet operations.

The sequence demonstrates operational continuity between espionage and financial theft, with job-market lures now integrated into supply-chain entry vectors. Rebuilt wallet infrastructure and AI tooling have been deployed, yet the exposure of role hierarchies after the June probe indicates insufficient segmentation of wallet DevOps permissions.

Future incidents will test whether token-scoped container deployments and mandatory code-signing for internal tools reduce similar lateral movement.