Binance says the attackers behind a record cryptocurrency theft used a mix of social engineering and malware over several months, starting with a tampered installer and later a fake recruitment process aimed at an engineer. According to the company’s post-incident explanation, the operation also involved an internal AI tool that helped the attackers understand internal processes. While the incident took place in the crypto sector, the techniques described are directly relevant to European businesses of all sizes.

What happened

According to Binance’s postmortem, the attack began in June when a developer downloaded a tampered installer that had apparently been distributed through a malicious Google advertisement. Binance says this exposed information about engineers and their working methods.

The company says a second stage followed in September, when another engineer was approached by someone posing as a recruiter. Binance describes a staged trust-building process involving calls, multiple interview rounds and social media profiles before the target was asked to download a fake interview assignment. Binance says this helped the attackers deepen their access.

The Verge reports that Binance also said the attackers used an internal AI tool as part of the operation. Based on Binance’s account, the tool appears to have helped them collect or interpret internal information rather than serving as the original entry point.

At the time of reporting, the public details come from Binance’s own explanation of the incident as cited by The Verge. That makes the attack pattern important, even if some operational details may still depend on the company’s internal investigation.

Why it matters for European businesses

This case shows how modern attacks often combine familiar methods instead of relying on a single advanced exploit. A malicious ad, a compromised software installer, impersonation of a recruiter and misuse of internal tools are all techniques that can affect ordinary companies, not only cryptocurrency platforms.

For European businesses, the practical lesson is that people, software supply chains and internal AI systems can all be part of the same attack path. A company may invest in endpoint security and still remain exposed if staff download software outside approved channels, if hiring conversations are not treated as a security risk, or if internal AI tools can reveal operational context to the wrong user.

The report is also relevant because many SMEs are now adopting generative AI tools internally. If these systems can access documentation, engineering notes, support data or process knowledge, they may become useful sources of intelligence for attackers who compromise an account or device.

Who may be affected

• SMEs and founders that rely on informal hiring, contractor onboarding or unmanaged software downloads.
• IT and engineering teams whose staff may be targeted through fake technical tests, installers or developer tools.
• Marketing and operations teams using internal AI assistants connected to company knowledge bases.
• E-commerce and digital businesses where account compromise could expose payments, customer data or operational systems.
• Agencies and fast-growing companies that work with freelancers, remote hiring and multiple SaaS platforms.

What companies should consider

• Treat recruitment as a security risk area. Staff should be trained to handle unsolicited interview tasks, coding assignments and software downloads with caution, especially when a file must be installed locally.
• Restrict software installation paths. Encourage downloads only from approved vendors or internal software management systems, and review controls for devices used by developers and administrators.
• Review protection against malicious advertising. Attackers can place convincing ads that lead to fake tools or installers, so web filtering and browser security policies may help reduce exposure.
• Assess internal AI tool permissions. Companies using AI assistants connected to internal data should review what information these tools can access, who can query them and what logs or safeguards are in place.
• Apply least-privilege access. Limit how much any single employee account or device can expose if compromised.
• Strengthen awareness for social engineering. Fake recruiters, supplier impersonation and trust-building over several calls are now common tactics, particularly against technical staff.
• Prepare incident response for blended attacks. Security teams should assume an attacker may move from phishing or malware to internal reconnaissance and account abuse rather than stopping at the initial infection.

For European companies, the broader takeaway is clear: cybersecurity planning should cover not only phishing emails, but also hiring workflows, paid search exposure, contractor interactions and the security model of internal AI systems.