According to the report, the attack started when an employee from Binance’s wallet developer team downloaded an AI tool in June that had been tampered with. The crypto exchange detected the compromise, replaced the device, and changed credentials. But the employee’s role, and that of others on the wallet team, was exposed to the hacker. A second software engineer was targeted in September.
The engineer was seeking a new job and downloaded a “malicious code repository” onto his computer after interviewing for what he thought was a legitimate role. The interview process included a virtual meeting with the CEO of a fictitious company.
On October 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer’s system and that of a second wallet developer on that team.
On 29 October, the attacker used the second wallet developer’s computer, using stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
- Scary to hear that it all started with someone trying to download Homebrew, but at the same time who the fuck clicks on Google ads when looking for development tools?
- I wish they would have given more details about how the hackers managed to spread from the second dev’s machine into the third and fourth’s, which they actually used in the end.
I’ve watched family members Google [software name] e.g. Adobe Acrobat and the top two results are ads for clearly malicious impersonations. Same thing happens in Duck Duck Go; but at least you can turn off ads in advanced settings. It’s just more proof that every advertisement is malware
There’s something sort of poetic in an engineer working for a massive crypto company, probably already very well paid, shirking his ethics to use his company laptop to apply for another job, and then opening them up to a breach. Breed a culture of selfishness, get pwned by a more progressively selfish system.
Remember the founder of Binance:
He resigned as the CEO of Binance in November 2023 after the U.S Department of Justice alleged he violated the Bank Secrecy Act and the International Emergency Economic Powers Act.[2][3] He pleaded guilty and was sentenced to four months in prison in April 2024.[3][4] Zhao completed his sentence by September of the same year.[5] In October 2025, Zhao was given a presidential pardon by President Donald Trump.[6]
Zero sympathy for anyone involved, got what was coming
Really interesting way to have socially engineered the access
