Binance says hackers used fake job interview in record crypto heist
The gist
Binance says hackers used fake job interviews and malware to drain $6.3 billion in crypto on Oct 29.
The exchange says it repaid customers, but the culprit is disputed.
How it unfolded
- Jun 2026Attackers set up a fake version of a developer tool and lured a Binance Wallet DevOps engineer to install a tampered Homebrew installation for a popular AI coding tool found via a search engine. Binance detected the compromise, replaced the device and rotated credentials, but the employee's role and that of colleagues on the wallet infrastructure team was exposed.
- Sep 2026Attackers posed as recruiters and ran a series of job interviews with a second engineer seeking a new job, who downloaded a malicious code repository as an interview assignment containing hidden malware designed to evade security.
- Oct 20, 2026The attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer's system and that of a second wallet developer on that team.