On October 29, about $6.3 billion in crypto left Binance's hot wallets in roughly twenty minutes. It's the biggest crypto theft on record, and the FBI has attributed it to North Korea, to the group it calls TraderTraitor. The twenty minutes are the headline. The months before them are the lesson, because by Binance's own account nobody broke its cryptography, its wallets or its exchange. The attackers got in the way most attackers get in now: they talked people into running their code.
What Binance says happened
Binance published an initial report on November 3. As the press has relayed it, the break-in had two footholds and a long middle:
- June: a tampered Homebrew. An engineer on the wallet team searched online for a popular AI coding tool and ended up installing a doctored copy of Homebrew, the package manager most Mac developers use. Binance spotted the unusual activity, replaced the laptop and rotated the engineer's credentials. Too late: the attackers had already learned who worked on the wallets.
- September: a job interview that wasn't. A second engineer was approached on a real job-hunting platform by someone posing as a "project director". There was an HR interview on video, a social media account full of personal photos to build trust, then a second interview with a supposed CEO. Near the end he was asked to download a coding "assignment" onto his work laptop. The setup step ran malicious code that swapped part of a Python tool for a backdoor. Binance says its endpoint security didn't catch it.
- October 20 to 29: the long middle. From those machines the attackers worked their way to other engineers' computers, found a deployment token, and on October 29 used stolen credentials to reach the service that signs wallet transactions. Then came the twenty minutes.
Binance's words: "It was not a single isolated breach or a simple phishing incident." And: "This should not have happened." To its credit, it says it has replaced almost all of the affected funds from its own pocket, and about $2.85 billion has been frozen or intercepted.
The common thread: the victim runs it
Look at the two footholds side by side. A search that leads to a fake download. A friendly recruiter who hands over a "test". Different costumes, one move: a stranger puts code in front of a person, and the person runs it. No exploit needed, because nothing is being broken into. The owner of the computer opened the door themselves.
That's the same move as ClickFix, the fake "verify you are human" page I've written about before. It tells you to press Windows + R, or open Terminal, paste a "verification command" it already put on your clipboard, and hit Enter. The command quietly downloads a password and wallet stealer. It works for the same reason the Binance footholds did: when you run something yourself, most of the protections in your operating system never get asked. The download didn't come through the browser's file checks. Nothing needed to be "approved". You approved it by pressing Enter.
And it isn't rare. North Korean groups have run fake job tests at scale for years, against developers in particular, and fake versions of popular developer tools pushed through search ads have been caught again and again. These people do it because it works on smart, careful engineers at one of the best-defended companies in crypto.
Three habits that break this chain
- Never run what a page, a recruiter or a chat hands you. If you need a tool, type its official address yourself; never install developer tools from an ad or a search result you didn't check.
- Assignments and "tests" go in a throwaway box. A virtual machine or a disposable cloud sandbox, never the laptop that holds your work, your keys or your wallet.
- "Just paste this to verify, fix or install" is a red flag, every time. No real CAPTCHA, video call or browser fix asks you to run a command.
Where ExecFence fits
I built ExecFence for the version of this trick that lives in the browser: a web page that puts a command on your clipboard and walks you into running it. ExecFence reads the page and the copied command on your own computer, and stops you before you paste, in plain words: what the page asked you to do, what the command would actually do (reach the internet, download a program, run it), and a button to wipe it off your clipboard. It stays quiet on real install pages where copying a command is normal, and nothing you copy ever leaves your machine. It's free on Chrome, Edge and Firefox, and Brave, Opera, Vivaldi and Arc install it from the Chrome listing.
To be straight about it: ExecFence wouldn't have stopped a coding assignment someone downloaded and opened in their editor. For that, the habits above are the defense. But fake pages that hand out a "paste this" command are exactly what it's built for, and those are how this kind of attack reaches most people who aren't Binance engineers: the parent clearing a "browser error", the gamer "verifying" for a download, the small office fixing a "Teams problem".
Not sure about a command somebody sent you? Paste it into execfence.com/check and it tells you what it would do, without running anything and without sending it anywhere.
Make it a community thing
The fix for "the victim runs it" is more people who recognise the move. If you help anyone with their computer, put ExecFence on their browser and tell them the one rule: a web page never needs you to paste a command. And when you do land on one of these pages, report it. ExecFence's Report button sends it to Google Safe Browsing, Microsoft or Netcraft in one click, and every report gets a scam page blocked for everyone else a little sooner.
Sources
- NPR: A Binance engineer thought he was interviewing for a job. Then the hackers pounced
- Tom's Hardware: Binance heist began with fake job interviews and a malicious Homebrew download
- Fortune: North Korea used fake job interviews to trick a Binance engineer
- Chainalysis: tracing the Binance theft to North Korea
- CNN: Binance withdrawals resume following the hack