{"rewrite":{"id":"r_a197bc294bead1a4549fb596","clusterId":"c_3ce5fa0eee784aa4792049d1","slug":"binance-hack-traced-to-malware-hidden-in-a-fake-job-interview","model":"deepseek-v4-1-flash","headline":"Binance Hack Traced to Malware Hidden in a Fake Job Interview","summary":"Binance's investigation into the roughly $6.3 billion theft reported at the end of October 2026 found the intrusion began with a sham hiring process. An engineer was contacted on a legitimate job platform, interviewed by people posing as an HR representative and a CEO, and told to download an assignment that carried malware. A June 2026 supply chain incident and a tampered Homebrew package were part of the same wider campaign.","whyItMatters":"The theft did not come from a broken wallet or a cracked key but from an engineer downloading an interview assignment, which puts hiring pipelines and developer tooling on the same threat surface as the exchange itself.","webCardHtml":"\u003cp\u003eBinance\u0026#39;s account splits the operation into stages rather than one breach. In June 2026 an engineer who built and ran crypto wallets searched for a popular AI coding tool and downloaded a tampered Homebrew package instead. Security staff caught the anomaly, swapped the PC and rotated credentials, but job-role and teammate information had already leaked.\u003c/p\u003e\u003cp\u003eThe September 2026 stage moved to people. An engineer was approached on a legitimate job platform by someone claiming to be a project director, then sat a live video interview where a supposed HR representative shared personal photos and videos to build trust. A second interview on a social chat app ended with a request to download an assignment containing malicious code.\u003c/p\u003e","blueskyPost":"The Binance intrusion started on a legitimate job platform, not a trading exploit. Fake HR and a fake CEO are cheaper to run than breaking exchange security, and recruiting pipelines sit outside most security reviews.","twitterPost":"Binance lost roughly $6.3 billion to a fake job interview, not a trading exploit. Hiring pipelines get less scrutiny than exchange security.","threadsPost":"The Binance hack began on a legitimate job platform: an engineer was interviewed by people posing as HR and a CEO, then told to download an assignment carrying malware. Recruiting workflows sit outside the perimeter security teams harden, so the entry point was a fake employer rather than a fake exchange.","newsletterBlurb":"Binance's investigation into the roughly $6.3 billion theft found the entry point was a fake job interview. An engineer was approached on a legitimate job platform, screened over video by someone posing as HR, then told during a chat-app interview to download an assignment carrying malware. A June 2026 tampered Homebrew download was an earlier stage of the same campaign.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261104-binance-6-3-billion-heist-hacker-yuse-fake-job-interviews/\",\"title\":\"Binance $6.3 billion hack traced back to malware delivered via fake job interview\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5469,"outputTokens":703,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793767800,"createdAt":"2026-11-04T04:44:53.000Z","publishedAt":"2026-11-04T04:48:53.000Z","updatedAt":"2026-11-04T04:48:53.000Z"},"cluster":{"id":"c_3ce5fa0eee784aa4792049d1","canonicalTitle":"仮想通貨取引所Binanceから約1兆円が盗まれた事件は偽面接経由でマルウェアを送り込まれたのがきっかけだったことが判明","representativeArticleId":"a_ecda21b4d354477b4c9501f5","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-04T04:05:00.000Z","lastSeenAt":"2026-11-04T04:05:00.000Z","updatedAt":"2026-11-04T04:48:55.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261104-binance-6-3-billion-heist-hacker-yuse-fake-job-interviews/","title":"仮想通貨取引所Binanceから約1兆円が盗まれた事件は偽面接経由でマルウェアを送り込まれたのがきっかけだったことが判明"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["Binance reported the theft of roughly $6.3 billion worth of cryptocurrency at the end of October 2026.","An engineer was contacted on a legitimate job platform by someone claiming to be a project director and interviewed over video and a social chat app.","The fake CEO told the engineer to download an assignment that contained malware executing during setup.","In June 2026 an engineer downloaded a tampered Homebrew package while seeking an AI coding tool, exposing job-role and team information.","Binance counted 57 cyberattack cases in 2026 suspected of links to North Korea."],"pageLinks":{"healthSlugs":[],"storySlugs":[],"entities":[],"stories":[],"entitiesOk":true,"storiesOk":true}}