An interview worth 6.4 billion US dollars
At 10 a.m. San Francisco time on the second Tuesday of September 2026, a message popped up on the encrypted messaging app of a Binance software engineer.
The profile picture showed a middle-aged man in a gray suit, with "Project Director" noted on his profile page.
The first sentence he sent was very polite, with just the right amount of admiration: "I've looked through your technical background, and your work on underlying optimization is very solid. We are forming a team whose direction almost overlaps with what you are doing now. Would you be interested in having a chat?"
This engineer had worked in Binance's wallet development team for three years, and he had no shortage of job offers.
But this message from the other party hit a hidden point: the technical direction mentioned by the sender was accurate down to the module he had been delving into recently. Anyone who could say that sentence either truly understood the field or had done extremely in-depth homework.
He replied with two words: "Sure."
Two rounds of remote interviews were completed in the following period of time.
The first round was casual technical talk, and the other party responded to every question fluently.
The second round was with a different person, who introduced himself as the "Chief Executive Officer". After talking about the company's vision for 40 minutes, he threw out the final task: "We are used to asking candidates to complete a small practical exercise, which is not complicated. Just run through the idea you mentioned earlier. The code is here, pull it down and take a look."
The other party sent a "homework assignment", but it actually contained a malicious code library. The engineer did not hesitate, downloaded and opened it.
At that moment, he personally invited an invisible stranger into Binance's internal network.
This was not an isolated intrusion.
Binance's preliminary investigation report released on November 3 shows that the entire attack was a "carefully planned multi-stage attack campaign", and the attackers combined multiple means including "fake recruitment interviews, induced download of malicious software, intrusion into internal AI tools, terminal intrusion and advanced transaction authorization methods".
Rewind the time four months back.
In June 2026, an engineer from Binance's wallet development team downloaded a tampered software program. The internal system detected it in time and replaced the device for him.
The disposal looked clean and thorough.
But in that short window, the attackers had already obtained what they really wanted: the job function of this engineer, and the information of many of his colleagues in the team.
Who is in charge of the underlying layer of the wallet, who is in the same trust circle with whom, that map has been drawn.
June was the reconnaissance phase.
The interview in September was the delivery phase.
The malware in that "homework assignment" adopted sophisticated obfuscation and evasion techniques. It replaced the legitimate component of the development tool with a malicious version, and then used this replaced tool to establish communication with the external server controlled by the attackers.
There was no brute force cracking, no alert triggered on the email gateway.
Because the Trojan horse was not carried into the city by force, it was personally carried in by an insider, because that insider was told that the Trojan horse contained his future.
For nearly a month, the attackers did not rush to take action.
On October 20, the operation initially started. Starting from the laptop of the engineer hooked by the fake recruitment, the hackers took control of the computers of two other software engineers responsible for Binance's digital wallet through an internal AI tool of Binance.
The AI tool was not "deceived", it just faithfully executed the instructions issued by the person holding legitimate credentials. At this step, the attackers already had control of three machines, at least one of which led deep into the wallet system.
On October 29, the attackers remotely logged into the third engineer's computer and activated a malicious script.
The attack was officially launched.
According to a report by Agence France-Presse, the entire attack process lasted for about four hours.
What Binance's security team did in that window, how they blocked the intrusion, and when they cut off which link — no operational details were disclosed in public reports.
But looking back afterwards, the four-hour duration itself is a signal: the attackers did not use fake keys. Every access control read real credentials, and every signature request carried a legitimate identity.
Binance's preliminary report revealed that the total amount of digital assets involved was approximately 6.34 billion US dollars.
Reference News cited AFP's report: about 2.85 billion US dollars of which has been frozen. Binance stated that it will use its own funds and the user protection reserve fund SAFU to cover all losses caused by this attack.
Shortly after the attack, Binance announced a number of remedial measures: rebuild the affected wallet system in a new environment, rebuild the affected internal AI tools and access control systems, strengthen risk control of wallet services, deploy enhanced AI-based behavior anomaly detection, and hire third-party cybersecurity experts to conduct a comprehensive review of the incident.
---
The truth may remain pending for a very long time. But there is one clue that can be seen clearly without waiting for attribution: every link of that interview stepped on the softest spot of the security chain.
The recruitment platform was legitimate. The interview scripts were professional. That "homework assignment" was hidden in a seemingly harmless file, and did not trigger any alert.
The malicious code did not break open any door, it just allowed an internal insider to open a window that he thought was an opportunity on the machine he worked on every day.
This article is from the WeChat Official Account "Zhang Dongwei", author: Zhang Dongwei, published with authorization from 36Kr.