--- title: "It Turns Out Binance’s $6 Billion Hack Happened Because Its Employees Were Vibe Coding" description: "Binance has revealed the elaborate scheme hackers used to steal billions of dollars worth of cryptocurrency." date: "2026-11-05" modified: "2026-11-05" authors: - name: "Frank Landymore" job_title: "Contributing Writer" link: "https://futurism.com/authors/flandymore.md" url: "https://futurism.com/future-society/binance-heist-vibe-code-ai" categories: - "Blockchain" - "Cryptocurrency" - "Cybersecurity" - "Future Society" --- # It Turns Out Binance’s $6 Billion Hack Happened Because Its Employees Were Vibe Coding ![A color-treated photo of the back of a hacker sitting at a computer.]() *Shutterstock / Futurism* Billions of dollars of crypto stolen — in a hack that we're now learning involved corporate vibe coding efforts. You couldn't come up with a more quintessential cautionary tale for an era when employers are embracing AI at every level. After hackers [drained nearly $6.3 billion from the crypto platform](), Binance has revealed how the thieves pulled off what might be the heist of the century. In a [detailed report]() on its investigation published Tuesday, the company described an elaborate scheme that took place over months involving sham job interviews, old-fashioned phishing, and — yes — a hijacked AI tool. It began in June when an employee on Binance's wallet developer team thought they'd indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that's popular with software engineers, after clicking a malicious ad. Binance said it detected the anomaly, replaced the device, and changed relevant credentials. So far so good, except that the attack exposed the role of the employee and his colleagues on the wallet team to the hackers, giving them the opening they needed. From there, some classic social engineering went into play. A hacker, posing as a project director, reached out to another software engineer through a legitimate job-hunting platform to offer an interview first with an "HR representative" and then the "CEO" of a fake company. The fraudsters then earned the employee's trust by sharing a social media account with personal photos and videos, something that Binance said "was more advanced and deceptive than previously seen social engineering approaches." (It's unclear from the report, but perhaps these were fabricated with AI, adding another element of AI menace to this story.) Crucially, the follow-up interview was conducted over text. The engineer was asked to complete and download an "assignment" that contained malicious code that instantly executed once the employee began installing it. Among the things it changed was replacing a real development tool with a malicious version that could communicate with the hackers and execute commands. That all took place in September. Starting in October, the hacker used the compromised employee machine to leverage an internal AI tool and use it as a "springboard" to seize control of the computer and the computer of a third wallet developer. From there, they used credentials stolen from the first wallet team employee to log into the third employee's computer and trigger a malicious script that launched the attack. In all, the attack siphoned 233.46 million XRP, a form of crypto, from five wallets into the hacker's wallets, and then plundered other forms of crypto including bitcoin, in what may well have been the most lucrative heist of all time. The culprits remain unclear. The FBI immediately blamed a notorious North Korean hacking outfit, but Pyongyang has denied involvement. Binance, in its report, noted that it had thwarted "57 suspected North Korea-linked cyber threat cases" — up until the big one that breached their defenses, at least. **More on cybersecurity:** [*Residents Horrified as Hackers Seize Control of Emergency Alert System and Warn of Incoming Nuclear Attack*]() ## Author At Futurism, my work has often centered on bringing a sense of clarity and insight to complex topics ranging from the regulation of emerging technologies to the esoteric ideologies of Silicon Valley executives, while striving not to lose the poetic sense of awe inspired by often-obscure fields like astrophysics and quantum computing. I broke the story of CNET using AI to produce articles that turned out to be riddled with factual errors and plagiarism — a dam-breaking inflection point, as I've reported, that's inspired copycats and endless discourse while beguiling stakeholders ranging from tech giants to purveyors of spam around the web. My work at Futurism has been cited by publications including CBS News, the Los Angeles Times, Vice, Gizmodo, Engadget, the Verge, and Vanity Fair. I grew up in locales ranging from India to China, and now live in the exotic suburbs of Virginia. In my free time, I'm an avid reader of weird sci-fi literature, an aficionado of East Asian cinema, and, regrettably, a relapsed gamer. Allegedly, I’m working on a debut novel, currently untitled. ### Author social links [Bluesky]() ## More - [It Took Hackers Just 20 Minutes to Steal $6.3 Billion in Crypto from a Single Platform]() - [AI Browsers Can Basically Be Hypnotized Into Turning Against Their User and Carrying Out Devastating Hacks]() - [Blockchains Were Supposed to Be “Unhackable.” Now They’re Getting Hacked.]() - [Polymarket Just Can’t Stop Getting Hacked Over and Over Again]() - [Maybe Vibe Coding Should Be Called “Cuck Coding” Because You Just Sit in a Chair and Watch]() - [Companies Are Discovering a Grim Problem With “Vibe Coding”]() - [Man Hires Swarm of AI Agents to Go on Epic Hacking Spree Against Major Companies]() - [It’s Laughably Easy to Poison Open-Weight AI Models, Researcher Finds]()