Binance’s $6.3B Hack Followed a Coding-Test Trap Its Security Chief Had Described

What happened: Binance chief security officer Jimmy Su described how fraudulent coding assessments could compromise employee devices in a July 2026 interview, months before the exchange suffered its October 29 theft. According to the supplied incident reporting, an engineer contacted through a job-hunting platform in September downloaded a malicious repository presented as a coding assignment; investigators also traced the campaign to a tampered AI coding-tool installer downloaded by another employee in June. The attack drained $6.36 billion across 10 blockchains in approximately 20 minutes, with the FBI and blockchain analysts attributing it to the North Korea-linked TraderTraitor group; North Korea denied involvement.

Why it matters: The chronology points to a gap between recognizing a threat and preventing the workflow that enables it: Su’s warning came after the reported June compromise but before the September coding assignment and October theft. Binance says it froze approximately $3 billion with partners, replenished approximately 98% of impacted assets and blocked 57 suspected North Korean threats during 2026, but those figures describe different outcomes and should not be treated as interchangeable measures of recovery. The practical lesson is that hiring exercises and AI development tools deserve scrutiny as routes into privileged systems; knowing the social-engineering script does not, by itself, demonstrate that the associated access controls will hold.

Source: Cointelegraph; incident details: The Block.