Binance $6.3bn theft via fake job interview, FinCEN cuts off MEXC

This week in one line: Binance explains how a fake job interview led to a $6.3bn theft, FinCEN cuts MEXC off from the US financial system, and Chainalysis takes its transaction monitoring offline.

Interested in a daily 2-minute brief on the risk and compliance developments to act on? Find out more →

Top story

Binance details how a fake job interview led to a $6.3 billion (Dh23.1 billion) theft

Binance co-CEO Richard Teng told CNBC on 3 November that the attackers "spent months building their way in", and that one employee's laptop was not the single point of failure. Binance's security report says an engineer installed a tampered AI coding tool in June, exposing the engineer's role and colleagues. Teng said that in September, attackers posing as recruiters ran job interviews with a second engineer and set a coding exercise containing hidden malware. They then moved through internal AI tools to the system that authorises wallet transactions, and the theft began on 29 October.

Teng said Binance has replenished 98% of the $6.34 billion (Dh23.3 billion) in affected assets. CNBC reports the FBI has linked the attack to North Korean hackers; Teng did not attribute it himself.

So what? Treat recruiter contacts, coding exercises and outside installers as an attack path, and require a second approver for large transfers.

Relevant if… you run a treasury, payments or digital asset function, or hire technical staff.

Also this week

FinCEN cuts MEXC Global off from the US financial system

Treasury says FinCEN issued an order on 6 November prohibiting US financial institutions from sending or receiving funds, including crypto, to or from MEXC Global. FinCEN's order states MEXC facilitated $16.7 billion (Dh61.3 billion) in funds linked to illicit finance, including sanctions evasion and cybercrime, between May 2021 and May 2026. It takes effect 30 days after Federal Register publication and does not change Bank Secrecy Act or OFAC obligations.

So what? Search your customer, counterparty and wallet data for MEXC exposure now.

Relevant if… you serve or process payments for crypto businesses, or rely on US dollar correspondent relationships.

DFSA publishes insights paper on how agentic AI changes cyber resilience

The Dubai Financial Services Authority, with Cambridge's C:>DIR, announced on 30 October a paper, Frontier and agentic AI: cyber resilience in the financial sector, ahead of a 2 November discussion at the Dubai FinTech Summit. It assesses resilience on four tests: speed, reach, authority and trust, including dependencies on shared models, cloud and identity services. The DFSA says the paper is not regulatory guidance and creates no supervisory requirements.

So what? List the AI agents and tools with system access, who owns them and how you would stop and recover them.

Relevant if… you are DFSA-regulated, or deploy AI agents or copilots with system access.

Chainalysis takes crypto transaction monitoring offline after a security incident (developing, as of 6 November)

Chainalysis said on 30 October that it was the target of a cybersecurity incident. In a 4 November update it said names, usernames, password hashes and live tokens for all users were exposed, and it took KYT, its real-time transaction monitoring product, and other address screening tools offline. It said it has no evidence that investigations data was accessed. Its 6 November update says KYT and address screening are being restored in phases, with Reactor and Data Solutions still offline. Every user must reset passwords and rotate API keys. Chainalysis says the incident is unrelated to the Binance theft.

So what? If you use these tools, reset credentials, rotate API keys and review what monitoring was missed during the outage.

Relevant if… you use Chainalysis KYT, Reactor or address screening.

ADGM publishes dedicated crypto mining guidance

ADGM says it is the region's first international financial centre to publish dedicated crypto mining guidance. Issued by its Registration Authority on 28 October, it treats mining as a licensable commercial activity, not a regulated financial service. ADGM says applicants must disclose their corporate structure, ultimate beneficial owners and on-chain reward-flow addresses, and calls this a first phase.

So what? If you onboard mining or hosting firms, expect UBO and wallet-address disclosure.

Relevant if… you serve crypto businesses linked to ADGM.

On the radar

The Central Bank of Kuwait urged the public on 3 November to report unlicensed money transfer, financing and electronic payment link activity.

Who’s hiring

Head of Wealth Risk, UAE and Middle East, HSBC, Dubai. Apply on the employer's careers page →
Head of Risk Management, Doha Bank, Dubai Branch. Apply on the employer's careers page →

Action of the week

Run MEXC through your sanctions and counterparty screening before the Treasury order takes effect.

SignPath Weekly is for general information only and is not legal, regulatory, tax, financial or compliance advice. It summarises the public sources linked in each item and may contain errors or become outdated, so check the primary source and take professional advice before acting. References to named companies report public actions as stated in the cited sources. The views expressed are the author's own and not those of any employer or organisation. To the fullest extent permitted by law, the author accepts no liability for loss arising from reliance on this newsletter. Spotted an error? Reply and I'll review and correct it.