Binance Hackers Steal $6.3 Billion Using Fake Job Interviews
In its initial security report, Binance explained how attackers carried out a sophisticated, multi-stage cyberattack. The operation began in June and eventually compromised three software engineers’ computers. Consequently, the attackers gained access to critical systems and executed the massive theft on October 29.
The attackers continued moving cryptocurrency even after Binance detected the breach. Although the exchange quickly restricted withdrawals and froze assets, the hackers continued stealing funds for nearly four hours.
Meanwhile, the FBI has blamed a North Korean hacking group for the incident. However, North Korea has rejected the allegations. Binance has also confirmed that it will repay customers whose funds were stolen.
The incident has renewed concerns about cryptocurrency security. Furthermore, it highlights how cybercriminals increasingly exploit employees through sophisticated social engineering techniques.
Cybersecurity experts have repeatedly warned about fake recruitment campaigns. These attacks often target employees at companies of interest, said Michael Barnhart, a researcher with cybersecurity firm DTEX.
According to Barnhart, fake job interviews remain a well-known hacking technique. Binance also reported detecting and preventing 57 suspected North Korea-linked cyberthreats in 2026.
That figure demonstrates the scale of the ongoing threat. Barnhart said Binance is “just getting barraged.”
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its report.
How Hackers Compromised Binance Engineers
The attack reportedly began in June when an employee on Binance’s wallet development team downloaded a compromised internet tool. Although Binance subsequently detected the problem, it replaced the device and changed the employee’s credentials.
However, the attackers had already exposed the employee’s role and those of other wallet development team members.
A person familiar with the incident revealed another detail about the initial compromise. The malicious version of the tool appeared inside an advertisement. Consequently, it ranked higher in search results than the legitimate software.
In September, attackers targeted another software engineer seeking employment. According to Binance’s report, the engineer downloaded a malicious code repository after attending a fake job interview.
The recruitment process appeared convincing. It even included a virtual meeting with the CEO of a fictitious company.
On October 20, the attackers exploited the compromised computer alongside an internal AI tool. As a result, they gained control of the wallet developer’s system and another developer’s computer.
Nine days later, the attackers launched their final operation. They used the second developer’s computer and credentials stolen from the first developer.
They then executed a malicious script to initiate the cryptocurrency theft. However, access to wallet systems remained restricted to a limited number of engineers.
A person familiar with the incident confirmed that only a small group of engineers had direct access to wallets. These systems store and facilitate cryptocurrency transactions.
$6.3 Billion Cryptocurrency Theft Unfolded Within Minutes
The main attack occurred on October 29. Within just four minutes, hackers transferred 233.46 million XRP from five Binance hot wallets. They moved the cryptocurrency into an address controlled by the attackers.
However, XRP was not their only target. The attackers subsequently withdrew other cryptocurrencies, including Bitcoin.
Binance received an internal alert about unusually large transfers. It immediately launched an investigation and began restricting suspicious activity.
The exchange suspended withdrawals, froze affected tokens and removed unauthorised permissions. Consequently, it managed to freeze approximately $2.85 billion in assets.
Nevertheless, suspending withdrawals alone could not prevent every unauthorised transaction. The attackers had already established access to critical systems.
Furthermore, they used 50 signing transactions to manipulate the accounts. Binance had to develop new procedures to revoke authorisations, which slowed its response.
According to the security report, the final unauthorised transfer occurred at 23:56 GMT. That was almost four hours after the initial attack began.
Following the incident, Binance announced additional security measures. These include greater investment in AI-powered threat detection and improved monitoring systems.
The exchange also plans to establish a security research fund. Additionally, it intends to launch targeted security initiatives with leading AI companies.
The incident highlights the growing risks facing cryptocurrency platforms. More importantly, it demonstrates how a single compromised employee account can expose even sophisticated financial systems to devastating cyberattacks.
