It started with a dream job.
A recruiter reaches out on a job site. A friendly HR video interview. A chat with the company’s CEO. Then the last step: a small coding assignment.
Download it. Run it. Show us what you can do.
The engineer did what thousands of job seekers do every week.
A few weeks later, $6.3 billion left Binance’s wallets in a single evening.
Last week, I explained what happened in the biggest crypto heist in history. Back then, all we knew was that it “may have started with a compromised laptop.”
Now Binance has published its post-mortem that I was really looking forward to! So let’s get into it and find out what exactly happened.
What you can expect from this article:
The full attack chain, step by step, in four acts
The red flags nobody caught and probably should have
Why stopping withdrawals didn’t stop the theft
What actually failed, and which cybersecurity fundamentals could have prevented this attack
(Missed the first article? Start here: The $6.3 Billion Binance Hack, Explained in Plain English)
Act 1: The Poisoned Tool (June)
Months before the heist, one of Binance’s wallet DevOps engineers, let’s call them Engineer A, wanted to install a popular AI coding tool.
The installation went through a tampered Homebrew installation, a package manager many developers use every day. Somewhere along the way, it had been poisoned.
Binance actually caught it. The security team flagged the anomaly, replaced the device and rotated the credentials.
Problem solved?
Not quite. According to the post-mortem, the attacker had already learned something valuable: who works on the team, and who reports to whom.
They didn’t need the laptop anymore. They had the map.
💭 Pause here: Binance did almost everything right in June. So what was the real damage? Information. Attackers don’t just steal data. They steal context, and use it later.
Act 2: The Dream Job (September)
Engineer B gets a message from a recruiter on a job site.
What followed looked completely professional:
A video interview with “HR”
A social media profile that made the recruiter look legitimate
An interview over a chat app with the “CEO” of a company that, it turned out, didn’t exist
A coding assignment to download, on a work computer
The moment the setup ran, it quietly replaced a common developer tool (pyenv) with a doctored copy and connected to a server controlled by the attacker.
Endpoint protection didn’t notice a thing.
🚩 Your turn: spot the red flags. Before you scroll, how many warning signs can you find in that story? Count them, then check below.
The red flags:
The work computer. A job interview for another company, done on your current employer’s device. That alone is a really bad idea!
Running unknown code. The “assignment” required running someone else’s setup scripts.
A company that’s hard to verify. If you can’t find real traces of a company outside its own website and profiles, be careful.
The interview moving to a chat app, with the “CEO” personally involved early on. It flatters you, and it moves the conversation away from standard platforms.
(The last two are general warning signs of fake recruiter scams, not specific details from Binance’s report.)
Act 3: The Jump (October 20)
Now the attacker had a foothold on Engineer B’s computer.
But Engineer B didn’t have access to the money. So the attacker needed to move.
According to Binance, the attacker used Engineer B’s machine and an internal AI tool to take control of the computers of Engineer A (yes, the same engineer from June) and a third engineer, Engineer C.
On Engineer A’s machine, they found something valuable: a token that could deploy containers.
Binance hasn’t explained how the AI tool was used to reach other machines. It has rebuilt that tool and its access controls since.
💭 Pause here: companies are rushing to give AI tools broad access, to code, systems and other employees’ environments, so they can be helpful. What happens when an attacker gets to use that same helpful tool? I think you know where I am going with this.
Act 4: The Heist (October 29)
17:15 to 19:56 UTC: the attacker logs into Engineer C’s computer, uses Engineer A’s stolen credentials, deploys a container and runs a malicious script.
That gives them access to the crown jewels: Binance’s internal wallet-signing service, the system that approves transactions.
20:05 UTC: the money starts moving. XRP first, then Solana, Optimism, Bitcoin and Ethereum.
No wallet was cracked. Binance says there’s no evidence a private key leaked. The attacker simply used the system that was already allowed to approve transactions.
Why Stopping Withdrawals Didn’t Stop the Theft
Binance suspended withdrawals that night.
But there was a catch. The money kept leaving anyway.
How is that possible? Shouldn’t a company like Binance be able to suspend withdrawals whenever it wants?
Well, for once, their own security controls turned against them.
Among the roughly 50 transactions the attacker pushed through the signing service were delegations: on-chain permissions that let a contract controlled by the attacker act on Binance’s hot wallets.
Think of it like a signed power of attorney. Closing the bank’s front desk doesn’t cancel a power of attorney that’s already been signed. The attacker could still act on the wallets, because the permission lived on the blockchain, not in Binance’s systems.
And canceling it wasn’t simple. Binance uses MPC, a setup that splits signing power across several parties so no single key can sign alone. That’s normally a strength. But it meant there was no quick way to sign a revocation, so Binance had to build a special procedure in the middle of the incident.
23:56 UTC: the last transfer finalizes.
00:10 UTC, October 30: Binance finally clears the delegation, just over four hours after the first transfer.
💭 Pause here: The attacker spent months on people, and about four hours on systems. Maybe we should consider that in our security budgets, right?
Didn’t expect that twist? Hit the ❤️ and restack this, so more people see how this attack really worked.
Summary in numbers
About $6.34 billion in impacted assets, according to Binance
About $2.85 billion frozen or intercepted
98% of the affected tokens replenished by Binance from its own funds by October 31. That means Binance replaced them. The stolen funds weren’t recovered.
Withdrawals reopened gradually from November 1
The FBI attributes the theft to TraderTraitor, a North Korean hacking operation. North Korea denies it.
And Binance’s own verdict, according to reports on the post-mortem: this incident should not have happened.
What Actually Failed
Here’s the uncomfortable part. Not one of these failures is new.
So let me put it in one picture and remind you of the things that could have prevented this attack.
Conclusion
The biggest crypto heist in history didn’t start with a genius hack of the blockchain.
It started with a recruiter message, and with an engineer who wanted a new job.
Every step after that was possible because a fundamental was missing somewhere. That’s the real lesson. The attacks keep getting more sophisticated, but the doors they walk through are the same.
Now I want to hear from you: looking at the four acts, at which step do you think your company would have caught it? Tell me in the comments. I read every response.
PS: NEVER use your company laptop for personal things, especially job interviews!
Where to Go Next
The first part of the story:
Social engineering, least privilege and incident response are core topics of the CC exam. Would you make the right call in situations like this? Take the free CC Readiness Test: 15 minutes, a score for each domain:
This story is still developing. Binance describes its report as initial, and some details, including how the AI tool was used, haven’t been published yet.
Let’s Connect
If you want to collaborate, discuss, or just geek out over networking and cybersecurity, reach out:
Email: erich.winkler@decodedsecurity.com
LinkedIn: Erich Winkler
Gumroad community: Decoded Security
Start Here: Decoded Security Roadmap
Enjoyed this article? Like it or drop a comment. I’d love to hear your thoughts and questions!
Let’s learn and grow together!