Binance says fake job interviews let hackers steal $6.3 billion
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Binance says hackers used fake job interviews to breach an engineer's laptop and steal about $6.3 billion.
The record crypto heist puts social-engineering attacks on exchange staff in focus.
Background
Binance is the world's largest cryptocurrency exchange by daily trading volumes, led by CEO Richard Teng. According to its incident report, the breach began with a DevOps engineer whose laptop was compromised, possibly letting hackers reach a service container and submit unauthorized withdrawal requests. Binance said the hackers used social engineering, contacting an engineer through a legitimate job-hunting platform and inviting him to bogus interviews with fake company representatives. The tactic was already documented: Microsoft, Kraken and Coinbase had warned of or disclosed similar suspected North Korean infiltration attempts before the breach.
How it unfolded
- 2026 -06An engineer downloaded a tampered version of Homebrew while searching for an AI tool; Binance detected the infection, replaced the computer and changed credentials, but attackers had already gathered information about the employee and the wallet team.
- 2026 -09Another engineer was approached through a legitimate recruitment platform and invited to bogus interviews with an HR representative and someone posing as a CEO, then told to download an 'assignment' containing malware that bypassed security software.
- Oct 20, 2026Attackers used the compromised computer and an internal AI tool to reach other Binance engineers.
- Oct 29, 2026Fraudulent withdrawals began; within hours about $6.3 billion was stolen, in an attack carried out over about four hours.
- Oct 31, 2026The FBI said the attack was carried out by TraderTraitor, a North Korean hacking unit.
- Nov 3, 2026Binance published its first incident report, said it had replenished 98% of affected assets and set aside more than 100% of the funds needed to cover the loss, and said it was reopening withdrawals step by step for dozens of tokens.
- Nov 3, 2026North Korea denied the claims; Kim Yo Jong called them a 'sinister attempt' by the US to damage North Korea's public image.
Who’s saying what
- Official
- Binance called it a 'serious and highly sophisticated security incident', apologised saying 'this should not have happened', and said it found no evidence private key wallets were compromised, with losses covered by its Secure Asset Fund for Users (SAFU) and company funds.
- Official
- Kim Yo Jong, a top DPRK official and sister of leader Kim Jong Un, called the accusations 'absurd rhetoric' and a 'sinister attempt' by the US to damage North Korea's public image.
- Analysts
- US crime agencies including the FBI and Secret Service, along with a range of cyber analysts, said the hack bore the signs of having been orchestrated by North Korea.
Still unverified
The FBI attributes the hack to North Korea's TraderTraitor unit; Pyongyang denies this and calls the claims a political provocation.