It started with a rigged coding assignment. It ended with $6.34 billion gone from Binance.
By Lior AharonovFounder, 7IT Solutions ·
What happened
Binance's incident report, published 3 November, says fake recruiters sent engineers a coding assignment carrying a rogue copy of a legitimate developer tool component. In June, an engineer had also installed a tampered Homebrew package while searching for an AI coding tool. The FBI blames TraderTraitor; North Korea rejects it, per SecurityWeek.
Why it matters
The attackers did not break the vault. They went through the people who build the software. Your developers' laptops, installers and take-home tests are the front door.
What to do
Open any candidate or recruiter code only in a throwaway VM. Install developer tools only from the official source, and keep signing credentials off engineer laptops.
My take
Lior Aharonov
Founder, 7IT Solutions
The weakest part of your stack is a tired engineer with a take-home test and admin rights.
Sources
| SecurityWeek: Rigged coding assignment, abused AI tool opened path to $6 billion Binance heist | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.