Fake Interviews and Internal AI Pivot Enabled $6.34B Binance Wallet Compromise

The intrusion began in June when one engineer downloaded malicious Homebrew code while searching for an AI coding assistant. Binance detected and isolated the device, but the attackers mapped team contacts. In September a second engineer received a fake interview request ending with a malicious repository that installed undetected 0-day malware, replacing a legitimate tool component and establishing command channels. On October 20 the compromised machines plus the AI tool pivoted to a third engineer, enabling container deployment and wallet signing abuse. Binance’s report shows the attackers exploited EIP-7702 delegations on an MPC wallet lacking single-key revocation, bypassing withdrawal suspension. Roughly $2.85 billion was later frozen. Technical logs confirm the sequence but provide no independent forensic artifacts linking the infrastructure to TraderTraitor; the FBI attribution rests on prior campaign overlaps rather than fresh code or C2 evidence. This incident exposes a recurring pattern: social-engineering supply chains targeting DevOps roles, followed by lateral use of internal AI tooling. Similar tactics appeared in earlier Bybit and Ronin breaches, where credentialed access and weak change-control processes enabled large-scale drains. Rebuilt systems and an announced AI-security research fund address symptoms, not the underlying absence of hardware-backed signing isolation. Independent reviews are underway and 57 additional North Korea-linked attempts were blocked this year. Expect further freezes on identified flows and renewed focus on AI-assisted internal tooling audits across exchanges.