Binance says fake job interview helped enable $6.34bn theft

Binance has disclosed how attackers used a fake job interview and malware in a breach that affected $6.34 billion in virtual assets, and says it will cover users’ losses. In its preliminary incident report, the exchange said the October 29 attack followed months of preparation and involved access to its wallet systems.

The report says Binance software engineer B was approached in September on a legitimate job-search platform by someone posing as a project director. After two interviews, B was asked to download a coding task to a work computer; Binance says its repository contained malware that evaded the company’s endpoint security tools. The exchange said the investigation is ongoing and its findings will receive independent review.

How did the fake interview lead to wallet access?

Binance says the recruitment scam was one stage in a wider operation, not the first sign of a compromise. The company reported that in June, another engineer downloaded a tampered version of Homebrew while trying to install an AI coding tool; Binance detected an anomaly, replaced the device and rotated credentials, but said the attackers learned about the engineer’s role and colleagues.

According to Binance, attackers later used B’s compromised computer and an internal AI tool on October 20 to gain control of two other employees’ computers. On October 29, they used stolen credentials and a container deployment token to reach wallet signing operations and trigger a malicious script. Binance said its hot wallets sent assets including XRP, SOL, OP and bitcoin to attacker-controlled addresses.

What does Binance say happened to the funds?

Binance reported that about $2.85 billion of the $6.34 billion in affected assets had been frozen or intercepted as of its November 3 update. It said the attacker had exploited unauthorized access to an internal signing service to make transactions outside the normal withdrawal process. Binance also said it had reserved more than enough company funds to cover the loss, and that 98% of affected token assets had been replenished by November 3.

The FBI has attributed the theft to North Korea, according to Binance’s report; the Washington Post also reported that the FBI and third-party crypto security firms had linked the heist to a North Korean hacking group. Binance said it detected and prevented 57 suspected North Korea-linked cyberthreats during 2026.

How does this differ from a simple phishing attack?

Binance described the incident as a multi-stage campaign combining social engineering, malware, compromised devices and an internal tool. A simple phishing attempt might seek a password through a deceptive message, but the exchange’s account says attackers built access through employee devices and then reached systems involved in signing transactions.

The company said it closed identified entry points, rebuilt or replaced systems reached through the attack path, and tightened device and wallet controls. Those are Binance’s preliminary findings and response steps; it said further investigation and independent security review are still underway.

Source material

• preliminary incident report — binance.com