The most expensive crypto heist in history did not begin with a brilliant exploit. It began with a Google ad. According to a postmortem published by Binance, one of its developers downloaded a tampered installer in June, apparently spread through a malicious advertisement, and in doing so exposed details about the company's engineers and how they work. What followed was a slow campaign of trust-building.

In September, a different engineer was approached by someone posing as a recruiter. There were calls, multiple rounds of interviews and shared social media profiles, all designed to look ordinary. Finally came a "take-home assignment", which was in fact malware. It deleted a legitimate development tool, pyenv, and replaced it with a malicious copy that gave the attackers a backdoor.

Binance says its tools missed this second attack, even though its security teams had caught the first infection in June and replaced the worker's device. The FBI attributes the operation to a North Korean unit called "TraderTraitor". By October 20th, Binance says, the group had used the company's own internal AI tool to gain control over wallets linked to the first compromised engineer and to a third employee. On October 29th it logged into the third employee's computer and struck.