Binance says $6.3B heist began with engineer's vibe coding

Binance's postmortem on its $6.3 billion wallet breach reads less like a zero-day exploit than a bad week on developer Twitter. According to the exchange's own report, written up by Futurism, a wallet engineer went to "indulge in some vibe coding by installing a popular AI coding tool" in June. What they actually installed was a tampered Homebrew package served through a malicious ad.

That alone didn't drain the wallets. Binance detected and remediated the install, but by then the attackers had what they needed. "Engineer A's role and his related colleagues on our wallet infrastructure team was exposed to the hacker," the company wrote.

Three months later they came back through a different door. Posing as a project director on a legitimate job-hunting platform, they ran a second engineer through a fake interview loop, with an impostor HR contact who "shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust." At the end, the fake CEO handed over an "assignment": malware inside a coding exercise.

From that foothold, Binance's own in-house AI tool became the pivot. "The attacker leveraged the compromised computer of Engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C," the exchange disclosed in a passage Fortune quoted in full. The actual withdrawals ran in roughly twenty minutes. The FBI attributed the theft to TraderTraitor, the North Korean crew linked to the Lazarus Group. Binance says Tether and Circle froze about $2.5 billion of the stolen stablecoins, and the exchange replenished the rest from reserves.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused," Binance said.