--- title: How a Fake Job Interview Led to the $6.34B Binance Hack description: A fake job interview and malicious developer software led to the October 29, 2026 Binance hack, affecting about $6.34 billion in digital assets. Attackers... canonical: https://daily.dev/posts/how-a-fake-job-interview-led-to-the-6-34b-binance-hack-pslc7rmxz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How a Fake Job Interview Led to the $6.34B Binance Hack | daily.dev og:description: A fake job interview and malicious developer software led to the October 29, 2026 Binance hack, affecting about $6.34 billion in digital assets. Attackers... og:url: https://daily.dev/posts/how-a-fake-job-interview-led-to-the-6-34b-binance-hack-pslc7rmxz og:image: https://api.daily.dev/og/posts/Pslc7RMxZ.png og:image:alt: How a Fake Job Interview Led to the $6.34B Binance Hack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How a Fake Job Interview Led to the $6.34B Binance Hack **[JS Development](https://daily.dev/sources/jsdevelopment)** · [@anliberant](https://daily.dev/anliberant) · 14 upvotes · 3 comments ## Summary A fake job interview and malicious developer software led to the October 29, 2026 Binance hack, affecting about $6.34 billion in digital assets. Attackers tampered with a Homebrew-installed developer tool, then used a coding assignment to plant malware on an engineer's work computer. They moved laterally using an internal AI tool and a container deployment token to reach wallet-signing infrastructure. The attackers abused Ethereum's EIP-7702 delegation mechanism on a hot wallet, and assets were transferred across XRP, Solana, Optimism, Bitcoin, and Ethereum. As of November 3, about $2.85 billion had been frozen or intercepted, and Binance said it would cover the losses. The FBI attributed the incident to North Korean actors associated with TraderTraitor, a separate attribution still pending independent review. The post details how developers can inspect package.json scripts, VS Code tasks, git hooks, and dev containers before running unfamiliar code. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@petermrozek** · 1 upvotes > Launching an unverified payload without any form of containment (VMs? anyone?) on the same hardware you do your current job (this is the biggest offense), given the amount of hacks, social engineering and supply chain attacks in the recent months? Has that person lived under a rock? 🙁 **@springtofigh** · 0 upvotes > What a disaster it must have been! **@akkitto** · 0 upvotes > If they would've done their research, this would've been extremely avoidable. This is nothing new and there have been tons of attempts from them to hijack various amounts of firms, specifically those in the West. --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto), [#vscode](https://daily.dev/tags/vscode), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/how-a-fake-job-interview-led-to-the-6-34b-binance-hack-pslc7rmxz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/how-a-fake-job-interview-led-to-the-6-34b-binance-hack-pslc7rmxz","headline":"How a Fake Job Interview Led to the $6.34B Binance Hack","text":"Shared: The Binance Hack: Why You Should Never Trust a Coding Assignment","url":"https://daily.dev/posts/how-a-fake-job-interview-led-to-the-6-34b-binance-hack-pslc7rmxz","datePublished":"2026-11-06T12:16:36.940Z","dateModified":"2026-11-06T12:17:55.998Z","author":{"@type":"Person","name":"Anton Liberant","url":"https://daily.dev/anliberant","image":"https://lh3.googleusercontent.com/a/AAcHTteX1jAsV7NIevHJk0k9z0vTRktfJmWn9I79VKpJ7Ypm1jqG=s96-c","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":5110}},"image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":14},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":3}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/s7SmvDF3J"},"comment":[{"@type":"Comment","text":"Launching an unverified payload without any form of containment (VMs? anyone?) on the same hardware you do your current job (this is the biggest offense), given the amount of hacks, social engineering and supply chain attacks in the recent months? Has that person lived under a rock? 🙁","datePublished":"2026-11-07T09:46:45.866Z","url":"https://daily.dev/posts/Pslc7RMxZ#c-2M5rdZkCz","author":{"@type":"Person","name":"Peter Mrożek","url":"https://daily.dev/petermrozek","image":"https://media.daily.dev/image/upload/s--pBfYX68K--/f_auto/v1769247960/avatars/avatar_Qz65P1nVw3Bu6C5YwaZgA?_a=BAMAMiiu0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"What a disaster it must have been!","datePublished":"2026-11-07T08:18:28.055Z","url":"https://daily.dev/posts/Pslc7RMxZ#c-mD56xiOo1","author":{"@type":"Person","name":"Spring Tofigh","url":"https://daily.dev/springtofigh","image":"https://avatars.githubusercontent.com/u/90114320?v=4"}},{"@type":"Comment","text":"If they would’ve done their research, this would’ve been extremely avoidable. This is nothing new and there have been tons of attempts from them to hijack various amounts of firms, specifically those in the West.","datePublished":"2026-11-08T12:27:34.274Z","url":"https://daily.dev/posts/Pslc7RMxZ#c-vGOCbC2wH","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/jsdevelopment","name":"JS Development"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JS Development","item":"https://daily.dev/squads/jsdevelopment"},{"@type":"ListItem","position":3,"name":"How a Fake Job Interview Led to the $6.34B Binance Hack"}]} ```