The largest crypto theft on record did not start with a supercomputer or a zero-day. It started the way so many bad weeks start: with a promising job opportunity.

According to the account Binance gave and Engadget reported on November 4, the operation that emptied $6.34 billion from the exchange on October 29 had been quietly assembling itself for months — one compromised engineer at a time.

A fuse lit in June

The first spark came in June, when an engineer who worked on wallet infrastructure downloaded a tampered installer for an AI programming tool. No alarms, no ransom note. Just a poisoned piece of software sitting inside the machine of someone with exactly the wrong — or, from the attackers’ perspective, exactly the right — level of access.

September brought the second act. Another engineer went through two rounds of interviews for what looked like a legitimate job. The process felt real enough to complete a work assignment, and that assignment file, supposedly sent by the company’s CEO, carried the malware. The hiring process itself was the exploit.

By October 20, the intruders were using one of Binance’s own internal AI tools to hop from those footholds onto the computers of two more engineers. Nine days later, on October 29, they ran their script with stolen credentials and the vault door swung open.

Twenty minutes

Investing.com’s October 30 report filled in the speed of the blow: most of the money was drained in roughly 20 minutes in the early hours of that Thursday. Citing Glassnode figures, Investing put the haul at about $1.66 billion in USDT, $1.45 billion in bitcoin and $767 million in USDC.

Then the chase began. Circle froze more than $800 million in USDC and Tether froze over $1.567 billion in USDT, while close to $3 billion ended up frozen with partners, according to Investing; Engadget’s later accounting put the frozen amount at $2.85 billion. Attribution came quickly: the FBI, and separately TRM Labs and Chainalysis, pointed to TraderTraitor, the North Korea–linked group that has made a specialty of exactly this kind of infiltration.

The week after

On October 30, Binance suspended withdrawals, telling users the funds were safe, that no private keys had leaked, that the breach traced back to a compromised DevOps engineer’s laptop, and that losses would be covered from the company’s own funds; withdrawals were expected to resume that Sunday. By October 31, Investing reported Binance had recovered 90% of the stolen $6.3 billion. Engadget’s November 4 reconstruction added the figure that matters most to customers: Binance says it restored 98% of affected assets and will absorb the loss itself.

Markets still flinched. On the day of the attack, Investing recorded bitcoin down 3.2% at $77,484, ether down 3.7% at $2,235 and BNB down 5.5%.

What it means for everyone else

Strip away the billions and the lesson is uncomfortably small-scale. The attackers never broke Binance’s cryptography; they broke its hiring funnel. A convincing recruiter, a patient two-round interview and one homework file did what brute force couldn’t. For anyone in crypto — or honestly, anyone with a LinkedIn profile — the defense is boring and human: verify recruiters through official channels, treat unsolicited “assignments” as hostile until proven otherwise, and remember that an exchange, however big, is still someone else’s computer. The people who held their own keys watched this heist on the news instead of in their balance.

The Bit Take

The most expensive onboarding in history ended with a $6.34 billion signing bonus — paid to the interviewers. If a “dream job” asks you to install something before the offer letter, the offer is the malware.

Sources