Binance Releases Preliminary Investigation Report: Two Wallet Engineers Targeted by Search Engine Phishing and Job Scam
On November 3, 2026, Binance released a preliminary investigation report on the October 29 security incident. The report said that this was a multi-stage operation rather than a single intrusion or simple phishing attack, with the attackers combining fake recruitment interviews, malicious software downloads, and abuse of internal AI tools.
The report said that in June 2026, Engineer A from the wallet DevOps team downloaded a tampered Homebrew installer package while searching for popular AI coding tools on a search engine. After the security team detected abnormalities, the device was replaced and the relevant credentials were rotated, but Engineer A's job information and information about colleagues on the wallet infrastructure team had already been exposed to the attackers.
In September of the same year, Software Engineer B was contacted on a legitimate job-seeking platform by someone claiming to be a project director. The other party arranged a video interview with a so-called HR representative, during which the other party shared a social media account containing personal photos and videos to build trust. This was followed by a second-round interview in a social chat application with someone claiming to be the CEO of a fictitious company. At the end of the interview, Engineer B was asked to download a repository containing malicious code as an assignment onto a work computer. This 0-day malware was not detected by endpoint security tools; after execution, it replaced components of legitimate development tools and established communication with attacker-controlled servers.
Original sources:
Title: 29 October 2026 Binance Security Incident: Initial Findings and Response Update Publisher: Binance Blog Publication date: 2026-11-03 URL: https://www.binance.com/en/square/post/384312159834579 Nature of source: official announcement Verification status: key full-text passages from this reading, including the Attack Preparation section Supporting content: the specific process and timeline in which Engineer A downloaded a tampered version of Homebrew through a search engine in June and caused colleague information to be exposed; the specific process and timeline in which Engineer B encountered a fake recruitment process through a legitimate job-seeking platform in September and infected a work computer by executing a malicious repository
ABAB AI Insight
Binance Chief Security Officer Jimmy Su publicly said as early as 2025 that people associated with North Korea were sending false resumes to Binance almost every day or trying to approach employees under the guise of recruitment, and that the tactics had evolved from simple identity spoofing to using voice changers and deepfake videos. In this incident, the way Engineer B was made to share personal photos and videos to build trust is precisely a continuation of this more advanced social engineering, with the attackers using information that the engineer mentioned Binance experience on a public job-seeking platform to carry out precise targeting.
The attack path shows a clear chain of resource acquisition: in June, tampered Homebrew distributed through paid search engine ads obtained intelligence on wallet team personnel; in September, a malicious repository was delivered to Engineer B's work computer through a fake company interview; on October 20, internal AI tools were used to move laterally from already compromised devices to Engineers A and C; and finally a container deployment permission token was obtained and the wallet signing service was triggered on October 29. Funds were not transferred directly through the compromised computers, but were completed through internal systems and on-chain mechanisms such as EIP-7702.
North Korea-related organizations, which the FBI has associated with activities such as TraderTraitor, have long used fake recruitment to target the crypto industry, highly resembling previous attacks on exchanges and custodians: first obtain internal personnel information or implant backdoors, then gradually approach signing or hot wallet privileges. The difference in this incident is that the attackers simultaneously used internal AI tools as a springboard, and the 0-day malware successfully bypassed the endpoint detection available at the time, showing that the attacker had carried out more targeted preparation for the target development environment.
This incident did not change Binance's promise that users' funds would be covered by the company for losses, but it did concretely change the reality of device and privilege management for the wallet infrastructure team: the affected wallet systems and internal AI tools have been rebuilt, devices have been replaced, and the relevant credentials have been invalidated. For the industry, search results for package management tools and recruitment processes that developers rely on daily have already become entry points that attackers can exploit at scale, and relying only on post-incident detection and device replacement cannot eliminate the subsequent risks brought by earlier intelligence exposure.
ABAB News · Cognition Law
Paid search engine ads can deliver tampered development tools precisely to target engineers.
Fake recruitment builds trust by sharing traces of personal life, and then asks the target to execute a repository.
Even after an incident has been detected and devices replaced, team personnel information may still remain for later attacks to use.