Binance $6.3 Billion Crypto Hack: Fake Job Interviews Used in Cyberattack
Binance Reveals How Fake Job Interviews Led to $6.3 Billion Crypto Hack
Binance has revealed how fake job interviews, malicious software and compromised internal systems were used in a major cyberattack that resulted in the theft of approximately $6.3 billion in cryptocurrency.
The world’s largest cryptocurrency exchange disclosed the details in an incident report published on Tuesday, November 3, 2026. The report described a months-long operation that targeted employees and eventually reached systems responsible for managing digital assets.
According to Binance, the attackers used a fraudulent recruitment process to trick a software engineer into downloading malicious code onto a work computer. They later exploited compromised devices and an internal artificial intelligence tool to gain access to other systems.
The incident has raised fresh concerns about cybersecurity in the cryptocurrency industry. It has also highlighted the growing risks associated with fake recruiters and seemingly legitimate job opportunities.
How Fake Job Interviews Helped Hackers
Binance said the attack involved several stages, with preparations dating back to June 2026.
During that month, an engineer working on wallet infrastructure downloaded a tampered software installation while attempting to install an AI coding tool. The exchange detected suspicious activity, replaced the affected device and changed the relevant credentials.
However, the attackers had already gained information about the engineer’s role and colleagues. This information reportedly helped them plan further attempts to access the company’s systems.
In September, another Binance engineer was approached through a legitimate job-hunting platform by someone posing as a project director at a fictitious company.
The employee participated in what appeared to be a normal recruitment process. The process included a video interview with someone claiming to represent human resources and another interview with an individual posing as the company’s chief executive.
The supposed employer eventually asked the engineer to download a coding assignment.
According to Binance, the assignment contained malicious code that compromised the employee’s computer. The malware reportedly evaded the security tools in place at the time.
Hackers Used an Internal AI Tool
The attackers did not immediately carry out the cryptocurrency theft after compromising the engineer’s computer.
Instead, Binance said they used the compromised device and an internal AI tool on October 20 to gain control of additional computers belonging to wallet developers.
This gave the attackers access to systems and credentials that could help them reach the exchange’s wallet infrastructure.
Nine days later, the attackers used stolen credentials and a malicious script to carry out unauthorised transactions.
The attack demonstrated how a single compromised employee device can become an entry point into a much larger corporate network.
It also showed how criminals can combine social engineering, malware and legitimate internal tools to bypass security barriers.
Billions of Dollars in Cryptocurrency Stolen
The theft occurred on October 29, when attackers transferred large amounts of cryptocurrency from Binance’s internet-connected wallets.
The exchange said the attackers moved approximately 233.46 million XRP from five wallets within four minutes before taking other digital assets.
Binance detected unusual transfers and worked to freeze or revoke access to affected systems. However, unauthorised transactions continued for nearly four hours as the company developed procedures to contain the incident.
The scale of the reported theft has made the incident one of the largest cryptocurrency heists ever disclosed.
Binance said it has frozen or intercepted approximately $2.85 billion in assets. It also reported that it had replenished around 98 per cent of the affected assets by October 31.
The company said it would cover affected customers’ losses rather than pass the financial burden on to them.
FBI Links Attack to North Korea
The Federal Bureau of Investigation has attributed the attack to a North Korean hacking group. North Korea has rejected the accusation.
The attribution highlights continuing concerns about sophisticated cyber operations targeting cryptocurrency companies and digital financial infrastructure.
Binance also said it detected and prevented 57 suspected North Korea-linked cyberthreats during 2026. Some reportedly involved similar methods, including fraudulent recruitment attempts and malicious software.
However, the specific responsibility for the latest attack remains disputed by North Korea.
Binance Strengthens Security Measures
Following the incident, Binance said it had closed the entry points used by the attackers and rebuilt affected systems in a new environment.
The exchange also replaced compromised devices, revoked exposed credentials and strengthened internal access controls.
In addition, the company plans to expand investment in AI-powered threat detection and cybersecurity research. It is also arranging an independent review of the incident.
The company said it would continue working with law enforcement agencies, cybersecurity specialists and industry partners to trace and freeze stolen assets.
Warning for Job Seekers and Crypto Companies
The Binance incident offers an important warning for employees and organisations.
Job seekers should be cautious when recruiters ask them to download unfamiliar software or run code as part of an interview assignment.
Companies should also verify recruiters, restrict access to sensitive systems and monitor unusual activity across employee devices.
For cryptocurrency platforms, protecting digital wallets requires more than securing passwords. Strong access controls, device monitoring and rapid incident response are also essential.
The Binance hack shows how criminals can exploit ordinary workplace activities to reach valuable digital assets.
As investigations continue, the incident is likely to intensify discussions about recruitment security, artificial intelligence and the protection of cryptocurrency infrastructure.
Read more at: Reuters.com
About the Author
