Binance’s $6.3B Crypto Heist Began With a Fake Job Interview and a Malware-Laced Coding Test

Hackers spent months compromising employees' computers before exploiting Binance's wallet infrastructure in a record-breaking cryptocurrency theft, according to the exchange.

Hackers allegedly used a fake job interview and a malware-laced coding assignment to compromise a Binance employee's computer before gaining access to the cryptocurrency exchange's wallet infrastructure in a $6.3 billion (£4.7 billion) theft, according to the company's account of the attack.

Binance said approximately $6.34 billion (£4.73 billion) in cryptocurrency was drained from its hot wallets on 29 October after a months-long campaign targeting employees involved in its wallet systems.

The exchange's incident report describes a series of intrusions beginning in June, followed by a fraudulent recruitment process in September and a final attack on its cryptocurrency wallets the following month.

Binance said it would cover affected customers' losses using company funds. It also reported that approximately $2.85 billion (£2.13 billion) of the stolen assets had been frozen or intercepted, while 98% of affected token assets had been replenished by 31 October.

How the Fake Job Interview Worked

Binance traced the first signs of the campaign to June, when a Wallet DevOps engineer downloaded a tampered Homebrew installation while trying to install an AI coding tool.

Homebrew is a software package manager used by developers. Binance said its security team detected the anomaly, replaced the engineer's device and rotated the affected credentials.

However, the attackers had already learned about the employee's role and colleagues working on the exchange's wallet infrastructure, according to Binance.

The campaign escalated in September, when another software engineer was approached through a legitimate job-hunting platform by someone posing as a project director at a fictitious company.

The engineer first attended a live video interview with someone claiming to represent the company's human resources department. A second interview took place through a messaging application with someone posing as the company's chief executive.

The purported recruiter shared social media accounts featuring personal photographs and videos to make the approach appear credible.

Near the end of the recruitment process, the engineer was asked to download a coding assignment from an online repository. Binance said the repository contained malicious code that compromised the employee's work computer.

The malware used sophisticated obfuscation and evasion techniques to avoid detection by security tools. It also concealed its activity, according to the exchange.

How Hackers Reached Binance's Wallets

On 20 October, attackers used the compromised computer and an internal AI tool to gain control of systems belonging to two wallet developers, Binance said.

The attackers subsequently used stolen credentials to access the exchange's wallet infrastructure and prepare the final stage of the operation.

On 29 October, they deployed a container and executed a malicious script using the compromised access.

Binance said the attackers exploited its wallet-signing infrastructure and an Ethereum transaction-authorisation mechanism known as EIP-7702 to initiate unauthorised transfers outside its normal withdrawal process.

The theft began at approximately 20:05 UTC, according to the exchange. Attackers transferred 233.46 million XRP from five internet-connected Binance wallets to an address under their control in about four minutes.

They subsequently moved other cryptocurrencies across multiple blockchain networks.

Binance detected the large transfers and began suspending withdrawals, freezing assets and revoking compromised permissions. However, unauthorised transfers continued for nearly four hours as the exchange worked to contain the attack.

The attackers' access was contained shortly after midnight UTC on 30 October, according to reporting on Binance's incident timeline.

Binance Replenishes 98% of Assets

Binance said approximately $2.85 billion (£2.13 billion) of the $6.34 billion (£4.73 billion) drained in the attack had been frozen or intercepted.

These were assets that the attackers could no longer access or use, rather than funds that Binance had necessarily recovered into its own wallets.

The exchange also said it had replenished approximately 98% of affected token assets by 31 October using company funds.

Replenishment does not mean Binance recovered 98% of the stolen cryptocurrency from the attackers. The exchange used its own funds to restore the affected assets and said it would continue purchasing outstanding tokens.

Binance said affected customers would not bear the financial impact of the incident.

The exchange also rebuilt affected systems, replaced compromised devices and revoked credentials and tokens associated with the engineers.

It said it was commissioning an independent cybersecurity review and expanding investment in AI-enabled detection, security research and initiatives with leading AI companies.

FBI Points to North Korea

The FBI attributed the attack to North Korea, according to reporting on the incident. The bureau linked the operation to the North Korean hacking group TraderTraitor.

North Korea denied involvement, describing the US accusation as 'absurd rhetoric', according to its state media.

Binance said its security team had detected and prevented 57 suspected North Korea-linked cyberthreats during 2026, including attempts involving fraudulent interviews and compromised software.

The exchange's co-CEO Richard Teng described the breach as a months-long campaign rather than an isolated security failure.

'This wasn't one mistake or one breach — it was a months-long campaign. We're publishing the full report because the lessons go far beyond Binance,' Teng said, according to The Block.

Binance also acknowledged the impact of the incident on its users and the wider industry, saying: 'This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.'

The attack highlights how cybercriminals can exploit routine recruitment processes to target employees with access to sensitive corporate systems. A coding assignment that appeared to be part of an ordinary job interview ultimately became one stage in a campaign that compromised the infrastructure of one of the world's largest cryptocurrency exchanges.

Binance said its investigation was continuing and that it would strengthen security controls following the breach.