Binance disclosed that a fake recruitment process enabled a "sophisticated, multi-stage campaign" that stole roughly $6.34 billion in digital assets. The attackers first lured a Wallet DevOps engineer in June 2026 to download a tampered Homebrew installer while searching for a popular AI coding tool. After rotating credentials, they later posed as a Project Director on a job-hunting platform, conducting two video interviews and convincing a second engineer to install a malicious code repository. The malware replaced a legitimate development component, evaded endpoint tools, and allowed the adversary to hijack an internal AI application, gaining a container deployment token from the first engineer. Using stolen credentials on October 29, the group deployed a container, ran a script on Binance’s wallet signing service and moved assets from five hot wallets, including 233.46 million XRP, 970,500 SOL, 44.2 million OP and 18,270 BTC. 1