The Recruiter Was Fake. The Job Was Fake. The $6.3 Billion Was Real.

At 20:05 UTC on 29 October, four months of preparation came due at once. By 23:56 the same evening, $6.34 billion in customer assets had left Binance’s hot wallets and scattered across eleven blockchains. The largest theft in the short history of cryptocurrencies was not pulled off by a genius. It was pulled off by someone who understood funnels.

Read Binance’s own incident report and a pattern emerges that should make anyone in marketing uncomfortable. The entry point was a job interview. The qualification process had two rounds. The trust-building used social proof. The conversion step was a download. That is not a security story with a marketing angle. It is a marketing operation that ended in a bank vault, run by people who never had to worry about click-through rates.

What actually happened, in one paragraph

In June, an engineer on Binance’s wallet team installed a tampered copy of Homebrew — a standard package manager for developers — while looking for a popular AI coding tool. In September, a second engineer was approached on a legitimate job platform by someone claiming to be a project director, sat through two interviews with a company that did not exist, and downloaded a “coding assignment” that ran malicious code the moment it was set up. On 20 October, working from that infected laptop, the intruders used Binance’s own internal AI tool to reach two more engineers. On 29 October they used stolen credentials to enter the wallet signing service and started moving money outside the normal withdrawal process. On 31 October the FBI attributed the theft to a North Korean group it tracks as TraderTraitor. Pyongyang called the allegation absurd.

That is the skeleton. The interesting parts are the joints.

Door one: the poisoned download

The first foothold was almost banal. An engineer searched for a developer tool, found an installer, and installed it. The copy was rigged. Reporting by Fortune describes the route as a malicious advertisement promoting a tampered version of the package; Binance’s report, meanwhile, refers to an engineer who “downloaded a tampered Homebrew installation” after searching for the tool online.

Binance noticed. It replaced the device, rotated the credentials and moved on. What it could not rotate was knowledge. By the time the laptop was swapped out, the intruders had already learned which engineer worked on wallet infrastructure, who his colleagues were and roughly how that team operated. The breach had been contained. The reconnaissance had not.

Anyone who buys media for a living should sit with that for a second. A paid search result was the front door of a nine-figure loss. Not a zero-day in a browser, not a poisoned update server — a sponsored link sitting where a download link was expected.

Door two: the interview that was a funnel

Three months later, a different engineer got the kind of approach thousands of people receive every week. A recruiter with a plausible title, a role that matched the CV and a company that looked real.

Binance’s report lays out the sequence with unusual specificity. The initial contact came through a legitimate job-hunting platform, from a profile that named the engineer’s employer. A first-round interview was scheduled with someone presented as an HR representative, who shared social media accounts full of personal photos and videos to establish that she was a person. A second round followed, conducted over a consumer chat app, with someone presented as the chief executive of a fictitious company. Near the end of that call, the engineer was told to download an assignment — a code repository — onto his work computer.

The repository executed during setup. It replaced a legitimate component of a development tool with a malicious version, used obfuscation to stay quiet, and opened a channel to an attacker-controlled server. Binance says its endpoint protection did not catch it at the time and describes the malware as having been built to evade exactly that layer of defence.

Now look at that sequence as a marketer, not as a target. Targeting: a profile matched to an open role. Qualification: two rounds, which is one more than most real processes bother with. Trust: borrowed social proof, delivered as photographs. Conversion: a single call to action, wrapped in professional obligation, at the moment the candidate is most motivated and least suspicious. Microsoft’s threat researchers put it in similar terms in March, noting that these campaigns exploit “the trust job seekers place in the hiring process during periods of high motivation and time pressure.”

The talent funnel is a marketing channel. It has targeting, creative, nurture and conversion. It has no fraud team.

The AI tool was the getaway car

Here is the part of the story that will be misread for years. An AI system was involved, so the headline writes itself: artificial intelligence helped rob a bank.

The model was not the vulnerability. The permissions were.

On 20 October, according to Binance, the attackers used the compromised laptop of the second engineer to operate an internal AI tool, and through it took control of the accounts of two other engineers — the wallet DevOps engineer first compromised in June, and a third software engineer. On the first engineer’s machine they found a token that allowed container deployment.

The company has not published how the tool was induced to act on someone else’s behalf, and it does not describe a flaw in the model itself. What it describes is a more ordinary and more widespread failure: an internal assistant that acted with the authority of whoever appeared to be sitting in front of it. No single dramatic exploit. Just an application that inherited the entitlements of its user, inside an environment where one user had deployment rights and three users had wallet access.

If you run an AI tool that touches production systems, marketing data, ad accounts or payment rails, the relevant question is not whether the model can be jailbroken. It is what that tool is allowed to do when the person typing is not the person it thinks it is.

Why the brakes came on fourteen minutes too late

The theft ran from 20:05 to 23:56 UTC. Binance says the bulk of the value moved in roughly twenty minutes.

Suspending withdrawals, the reflex response to any exchange incident, did almost nothing. The attackers had exploited Ethereum’s EIP-7702 mechanism, which lets an account delegate limited execution rights to a smart contract without handing over a private key. Binance describes the result as a malicious contract holding partial execution rights over a hot wallet. Those authorisations already existed on-chain. They did not care whether the exchange’s withdrawal queue was open or closed.

And because the hot wallets used multi-party computation, there was no single private key anyone could use to revoke those rights instantly. The architecture that removes single points of failure also removes single points of repair. Binance had to build a specific procedure to clear the authorisations, and by the time it did — 00:10 UTC on 30 October, fourteen minutes after the last unauthorised transfer settled — the money had gone.

Forty minutes that saved 44 percent

The recovery is the most under-reported part of this story, and the one with the clearest lesson for anyone who touches money on the internet.

Fifty-four percent of the haul, about $3.46 billion, was held in stablecoins. Stablecoin issuers can freeze balances. So the first thing the attackers did was try to swap out of them, and the first thing the issuers did was stop them. Elliptic’s tracing puts Tether’s freeze at thirty-seven minutes after the stolen USDT arrived. Circle froze all $823 million of stolen USDC before a single dollar of it had been swapped. Roughly $786 million was converted before the freezes landed.

Total frozen or seized: about $2.85 billion, or 44 percent of the haul — Elliptic measures that haul at $6.43 billion, counted at the moment of transfer. An extraordinary ratio by historical standards. After the $1.5 billion Bybit breach in February 2025, which the FBI also attributed to North Korea, only around three percent was frozen.

The difference was not better security. It was faster phone calls.

Then the money started moving like a spreadsheet

What followed the theft is the part that most coverage skips, and it is the part that tells you what you are actually dealing with.

In three and a half days, the funds passed through roughly 12,000 wallets across eleven blockchains and more than 40,000 transactions — a new wallet approximately every twenty-five seconds. On Tron alone there were about 32,000 transactions, peaking near 1,300 in a single hour, one every three seconds. Elliptic calculates that each dollar laundered on Tron was moved about nine times. Some batches crossed four blockchains in a few hours, through bridges, lending vaults, liquid-staking services, coinjoins and a privacy pool.

And here is the detail worth pinning to the wall: Elliptic looked for evidence of an AI agent driving that activity and did not find it. What it found was fixed timing, set amounts, blind retries, new tactics introduced in steps hours apart, and pauses that look like human working hours. The scale says software. The pattern says ordinary automation.

Two conclusions follow. First, the “AI did it” framing is mostly wrong, and being wrong about it will make you buy the wrong defences. Second, the attackers did not need intelligence at the laundering stage. They needed throughput. Half a billion dollars a year in sanctions-evading infrastructure does not require a reasoning model. It requires scripts that do not get tired.

Meanwhile, 18,270 stolen bitcoin was split into nineteen addresses in the same half hour and has not moved since. About $3.21 billion still sits in wallets tied to the theft, most of it untouched. Elliptic’s assessment is that this portion is very likely still held by North Korea, waiting for a slower, cheaper exit through over-the-counter brokers in the months ahead.

Zoom out: this is an industry, not an incident

Binance is the largest case. It is nowhere near the only one.

TRM Labs puts cumulative North Korean crypto theft at about $12.8 billion since 2017, with $7.4 billion of that taken in 2026 alone. Think about that ratio for a moment. More than half of a nine-year total was captured in ten months.

A joint advisory published on 18 September by Japan’s National Police Agency, the FBI, the US Defense Department’s Cyber Crime Center, Australia’s cyber security centre and Germany’s BND and BfV described one crew, tracked as WaterPlum and widely known as Contagious Interview, compromising at least 30,000 devices in more than 100 countries between December 2025 and July 2026, and taking funds or credentials from more than 7,000 crypto wallets. About $10.7 million was traced to North Korea. The same advisory ties some of those operators to the country’s IT-worker scheme, and notes that Japanese authorities dismantled a laptop farm for the first time — a room full of machines set up so that workers abroad could appear to be working locally.

Microsoft, which has tracked the same campaign since at least December 2022, describes a toolkit that keeps mutating: backdoors called OtterCookie, InvisibleFerret, BeaverTail and FlexibleFerret, delivered through coding assessments and fake interview sites, harvesting API tokens, cloud credentials, password-manager artefacts and wallet material. Its recommended countermeasure is disarmingly simple, and almost nobody has implemented it: run interview exercises in a disposable virtual machine, never on a workstation with production access.

That advice has been public for years. Which brings us to the uncomfortable part.

Why marketers should care more than they currently do

Most write-ups of this case will be filed under security. That is a filing error. Most of what went wrong here sits on a marketing surface.

The sponsored result is now an attack surface

The June entry point was a paid link in a search result. This is not exotic. Security researchers spent 2026 documenting one malvertising chain after another: fake installers for AI developer tools promoted through search ads, poisoned pages reached through legitimate click-tracking redirects, and — in a Citizen Lab investigation published in October — an advertising network used to deliver spyware with no click required at all.

The industry data matches the anecdote. ADEX’s State of Ad Fraud 2026, drawing on 1.2 million campaigns reviewed between January and September, found that 52 percent of distinct fraud schemes involved AI-generated or AI-assisted assets, 53 percent used cloned brands and fake endorsements and 11 percent used deepfakes. It also found a shift in method: cloaking’s share of suspensions fell from roughly 75 percent to about 45 percent, while malicious iOS scripts appeared as a new category at around a fifth of suspensions.

Ad verification, in other words, is now brand safety and security infrastructure at the same time. If your team buys search inventory in a category where people download software, you are not just bidding against competitors. You are bidding inside someone’s attack chain.

Recruitment is an unmanaged public channel

Binance says its security team detected and prevented 57 suspected North Korea-linked attempts during 2026. Fifty-seven. And the company still lost $6.34 billion, because the one that mattered did not arrive looking like a hacking attempt. It arrived looking like a job offer.

If you run employer branding, you are running a channel with no content moderation, no fraud scoring and no incident response. Job listings are public APIs for organisational structure. Recruiter profiles are free impersonation real estate. And the “assignment” is a file download your candidates are socially obliged to execute.

Your AI stack inherits your org chart

The AI tool did not break anything. It held the keys that the logged-in user held, in an environment where those keys opened two more accounts and a deployment token.

Most marketing organisations have now connected an assistant to something that can spend money: an ad account, a bidding tool, a CMS, a CRM, a reporting pipeline. Very few have mapped what that assistant can reach when the session it inherits belongs to someone it was never meant to trust. Permission sprawl is not a security-team problem that arrives by email. It arrives as a feature request.

Trust is the asset being arbitraged

Every stage of the Binance funnel borrowed credibility from an institution that had earned it: a legitimate job platform, a plausible employer, a real-looking recruiter with real-looking photographs, a developer tool that millions of people install without thinking.

Meanwhile, the defensive side of the industry spent the year arguing about whether AI-generated content would erode trust in advertising. It is a real question. But this case suggests a sharper one. The erosion is not happening at the level of the message. It is happening at the level of the channel — the interview, the sponsored link, the download page, the internal assistant. Channels are where trust is manufactured. They are also where it is now being harvested.

A short field guide

Concrete steps, in descending order of how much pain they prevent:

Treat interview exercises as executable code. Disposable virtual machines, no production credentials, no corporate SSO session. Microsoft’s guidance, published in March, still describes the gap most organisations have.

Assume recruiter inbound is untrusted. Verify the company domain independently of the message. Never open a repository from a hiring contact on a work device. Make it socially acceptable for a candidate to say “I will run this in a sandbox” — because right now the social pressure runs the other way.

Shorten the life of every token on a developer endpoint. The Binance chain worked because a deployment token sat on a laptop for months. Just-in-time credentials turn a four-month campaign into a four-hour one.

Audit what your AI tools can reach, not what they can say. Write down every system each assistant is authenticated against, and every action it can take without a human confirming. If that list is longer than the one for your finance team, stop.

Separate the roles that sign money from the roles that build software. The attackers needed one deployment token and one signing path. No single person should hold both.

Watch the freeze window like a media flight. Here, the difference between 3 percent and 44 percent recovered was measured in minutes. Pre-negotiated escalation contacts with stablecoin issuers and major venues are worth more than another dashboard.

Do not let non-public-facing staff build public profiles. Binance has said that employees in non-public roles are not permitted to maintain LinkedIn profiles. Whatever you think of the policy, the reasoning is sound: an org chart is reconnaissance.

Stop calling this an IT problem in your risk register. Two of the three doors here were opened by marketing-adjacent systems: paid search and recruitment. Budget accordingly.

The question nobody wants to ask

North Korea has been stealing cryptocurrency with recruitment lures for years. Microsoft has documented the pattern since 2022. The FBI has published advisories, named the group and, within two days of this theft, released the attacker’s wallet addresses and asked node operators to block them. The techniques are not novel. Elliptic’s own description of the laundering reads like a list of methods the industry already knew about.

So why does the largest heist in history look like a replay of a drill everyone had already run?

Because warnings are cheap and controls are expensive, and because the control that mattered here was not technical. It was organisational: a rule that a stranger’s code never executes on a machine that can sign a transaction. That rule costs a virtual machine and a little institutional friction. It was worth $6.34 billion on 29 October, and roughly half of that is still out there, in nineteen bitcoin addresses and a scatter of wallets that have not moved yet.

What to watch next

Three things, in order of how soon they will matter.

Agentic buying. As AI agents get delegated spending authority — ad budgets, procurement, subscriptions — the interesting attack stops being “steal the credentials” and becomes “instruct the agent.” ADEX lists prompt-injected ads written for AI agents among its 2027 predictions. Treat that as a schedule, not a forecast.

Freeze capability as a competitive feature. Forty-four percent recovery will be studied by every exchange, issuer and treasury team on earth. Expect stablecoin design choices about freezability to become a marketed attribute, in both directions.

Recruitment as a monitored channel. Once one company publishes that a fake interview cost it billions, the procurement questions change. Vendors that verify hiring contacts, or sandbox candidate environments, become line items.

The bottom line

A state actor built a conversion funnel, borrowed the credibility of a job platform, and converted a download into a foothold inside the systems that authorise the movement of money. The AI tool was not the weapon; it was the escalator. The defence that failed was not a model or a firewall. It was the assumption that a hiring conversation is not a distribution channel, and that a sponsored link goes where it says it goes.

Six point three billion dollars is a lot to pay for that assumption. Somebody should write it down somewhere the marketing team can see it.

Frequently asked questions

Was the Binance hack caused by AI?
No, not in the way most headlines imply. Binance’s report describes AI as an escalator, not an entry point: attackers who already had a foothold used an internal AI tool to reach other employees’ accounts. Elliptic, which traced the laundering, found automation but no evidence of an AI agent making decisions. The entry vector was a fake job interview and a tampered software installer.

How much of the $6.3 billion was actually recovered?
About $2.85 billion, or 44 percent, was frozen or seized within days — largely because 54 percent of the haul was stablecoin and issuers moved fast. Tether froze stolen USDT thirty-seven minutes after it arrived; Circle froze $823 million of USDC before any of it was swapped. Roughly $3.21 billion remains in theft-linked addresses.

Why couldn’t Binance just stop the transfers?
Two architectural reasons. The attackers used Ethereum’s EIP-7702 to grant a malicious contract partial execution rights over a hot wallet, so the authorisations lived on-chain rather than in Binance’s withdrawal system. And because the wallets used multi-party computation, no single private key existed that could revoke them instantly. The last unauthorised transfer settled at 23:56 UTC; the authorisations were cleared at 00:10.

Is this only a crypto problem?
The theft is. The mechanics are not. The two entry points were a paid search result and a recruitment conversation, and the escalation ran through an internal AI assistant that inherited a user’s permissions. Any organisation that buys search inventory, runs a hiring funnel, or connects an assistant to systems that can spend money shares the same three surfaces.

What should a marketing team do first?
Two things this quarter: make interview exercises run in disposable environments with no production access, and produce an inventory of what each AI tool in your stack is authenticated against. Both are cheap. Both would have broken this attack chain before it reached the wallet layer.