Binance Hack: Fake Job Interviews Preceded $6.3 Billion Theft

A staged job interview was one of the routes hackers used to take $6.3 billion from Binance. The intruders spent months inside the exchange, relying on methods that rival crypto firms had flagged well before the breach.

Binance disclosed on November 3 that the October 29 attack traced back to two engineers, each compromised through a separate path.

The earlier case dates to June, when an engineer searching for an AI tool downloaded a software package that had been tampered with.

Binance spotted the infection, swapped out the machine and reset credentials. Even so, the intruders had by then collected information on that employee and on the wallet team.

Then the fake interviews followed.

Fake Recruiting Scheme Cost Binance More Than $6 Billion

Another engineer was contacted in September through a genuine recruitment platform. The prospective employer set up video interviews with a supposed HR representative and a person presenting himself as the company’s CEO.

The engineer was eventually handed a coding assignment. The files he downloaded carried malware that got past the machine’s security software.

By October 20, the attackers had chained the compromised machine and an internal AI tool to reach further Binance engineers.

Deployment credentials were then stolen and used to plant malicious code in Binance’s wallet infrastructure.

Fraudulent withdrawals started on October 29. Roughly $6.3 billion had gone within hours.

Binance says about $2.85 billion has been frozen and 98% of the affected tokens replaced using company funds.

Rival Exchanges Had Flagged the Tactic Earlier

The recruiting playbook was already documented well in advance.

Kraken went public in May 2025 with a suspected North Korean operative who tried to join its engineering team.

Coinbase reported a further suspected infiltration in August 2026, describing how anomalous activity led it to identify a contractor who might have been compromised.

More pointedly, Microsoft warned in March that hackers tied to North Korea were running fake coding interviews to infect developers’ machines.

REVEALED: British companies are unwittingly funding North Korea’s nuclear programme, a Telegraph investigation can reveal.

Posing as legitimate remote workers, Kim Jong-un’s army of approximately 100,000 operatives sends job applications en masse and uses deceptive tactics to…

— The Telegraph, October 31, 2026

Why Wasn’t Binance Able to Stop It?

Three security questions now call for answers.

First, how was an employee able to run an untrusted coding assignment on a machine linked to corporate systems?

Second, how did the June infection still matter once Binance had found it and dealt with it?

Third, how did stolen deployment credentials end up unlocking systems that authorise withdrawals worth billions?

Binance has not said which safeguards broke down, or whether the earlier industry warnings had led it to add protections.

The FBI has blamed North Korea’s TraderTraitor group for the theft.

For Binance, the core question is how a recruitment scam that was already known ended up reaching the infrastructure that guards billions in customer assets.