The fake coding test behind the $6.3B Binance hack, and what developers should take from it

On October 29, 2026, about $6.3 billion left Binance's hot wallets on ten blockchains, most of it in about twenty minutes. No smart contract or blockchain was broken. According to Binance's own incident report (November 3), the way in was a chain of ordinary developer workflows: a tool install, a job interview, a coding assignment and a deploy token.

The chain, per Binance's report

• June: a wallet DevOps engineer looking for an AI coding tool installed a tampered copy of Homebrew. Binance caught it, replaced his laptop and reset his passwords, but says his role and his teammates on the wallet team had been exposed.
• September: a teammate, a wallet software engineer, was contacted on a real job site by a fake "project director". After interviews with a fake HR person and a fake CEO, he was asked to download a coding assignment from a code repository and set it up on his work computer.
• The payload: setting it up created /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_, deleted the real pyenv, renamed the new file into its place, replaced the /opt/homebrew/bin/pyenv link and spawned a zsh process (as reported by The Register and BleepingComputer). The fake pyenv took commands from the attackers' server. Binance's endpoint security didn't flag it.
• October 20: from that computer, and through one of Binance's internal AI tools, the attackers took over two more engineers' computers, including the first engineer's new laptop, which held a container-deployment token.
• October 29: they used that token to launch their own program inside Binance. It reached the signing service and created withdrawals outside the normal approvals.

The FBI attributed the attack to North Korea's TraderTraitor group. Fake recruiters with a "take-home test" are a long-running North Korean tactic (security researchers call it Contagious Interview).

Takeaways for developers

• A take-home test is code execution. Install scripts, postinstall hooks, Makefiles and setup scripts all run with your permissions. Do coding assignments from strangers in a throwaway VM or cloud sandbox with no credentials, never on a work laptop.
• Your PATH is an attack surface. Here the payload didn't drop an obvious new binary; it replaced a tool developers run every day. If you suspect anything, reinstall the tool from the package manager (brew reinstall pyenv) rather than trusting what's there.
• Deploy credentials shouldn't live on laptops long-term. One token on one laptop was enough to run code inside production. Short-lived tokens and approvals that a single compromised machine can't satisfy limit the blast radius.
• Internal AI tools are part of the perimeter. Binance says the attackers moved between engineers' machines through one of its internal AI tools. Anything that can act on several employees' machines needs the same scrutiny as a deploy system.

I made a 4-minute animated explainer of the whole chain for my channel, RUGPULL ILLUSTRATED (embedded above).

Sources: Binance's incident report (Nov 3, 2026), BleepingComputer, The Register, CoinDesk, the FBI. This post was generated with an AI agent and checked against those sources.