Binance Says Fake Job Interview Enabled $6.34 Billion Hack

By Marcus Bennett

Binance said attackers stole $6.34 billion in crypto after a fake software-engineering interview delivered malware to an employee, in an attack the FBI believes a North Korean state-sponsored ransomware gang carried out.

For the world’s largest cryptocurrency exchange, the reported loss surpassed the $1.5 billion Bybit hack from February 2025. The operation began with employee access, not a direct theft from a blockchain protocol.

The operation started months before the money moved. In June 2026, a Binance employee searched for a development tool. A malicious version appeared first in the results because of an advertisement, rather than the legitimate software.

Binance’s security team detected the anomaly, changed credentials and issued the employee a new computer. The attackers still learned the employee’s role and the names of colleagues who worked on wallet infrastructure.

Binance also described a recruitment-based intrusion. A supposed director at a company hiring for a role contacted the engineer. The target spoke by video with someone presented as a recruiter, then met someone claiming to be the organization’s CEO.

The supposed recruiter shared a social-media account containing personal photos and videos, making the approach appear more convincing. Eventually, the engineer received a coding assignment. After downloading its repository to a Binance-issued laptop, the engineer brought malware onto the machine.

Binance said the attackers spent months studying its operations and employees before targeting the engineer through a recruitment website, conducting the fake interview and issuing the coding test.

On October 20, attackers combined an already compromised employee device with an internal Binance AI tool. They used that access to breach the computers of two software engineers whose roles involved wallets. Binance said the tool “wasn’t simply an LLM used to generate phishing emails or malicious code.” The exchange did not explain exactly how the tool enabled the intrusions.

On October 29, stolen credentials and malicious code opened Binance’s wallet infrastructure. The attackers began moving billions. Most assets came from hot wallets connected to the internet and used for withdrawals and other transactions. The bulk of the transfer activity lasted about 20 minutes. It took roughly four hours for Binance to stop all unauthorized transfers and revoke access.

What does this change for customers?

For customers, the immediate financial answer is that Binance says it will absorb the loss. The exchange said it would not make customers pay and had replenished roughly 98% of affected assets from its own funds as of November 3. That covered most customer losses, but it did not erase the operational weakness exposed by the employee-device breach.

The transfer mechanics explain the scale. TRM Labs, a blockchain analytics firm, traced five Binance wallets sending a combined 233.46 million XRP in four minutes. It also traced 18,270 BTC leaving a hot wallet, worth about $1.47 billion at the time. Its estimate put the stolen Ethereum at roughly $3.79 billion.

TRM said the attackers extensively used EIP-7702, an Ethereum Improvement Proposal that lets standard wallets delegate transaction execution to smart contracts. Through signed authorizations, they gave contracts control over wallets and moved funds to addresses outside Binance’s normal withdrawal system.

As of November 3, Binance said it had frozen about $2.85 billion of stolen assets with help from partners. TRM tracked the remainder through multiple blockchains and decentralized-finance liquidity pools as the attackers tried to obscure its origin.

Customers pulled about $3.64 billion from Binance after news of the hack, Reuters reported, although withdrawals later stabilized. The reported outflow tested the exchange’s liquidity and customer confidence while Binance continued tracing and containing the theft.

Binance plans to increase spending on AI-driven threat detection and establish a fund for security research. Those measures respond to an attack that combined employee deception, a compromised device, stolen credentials and a transaction-control feature built into Ethereum.

Private-key security alone cannot contain a failure that starts with a convincing interview and a poisoned repository. The next test is whether Binance’s expanded AI detection and security-research fund can close the device-to-wallet gap before another hot-wallet transfer window opens.