Binance details how fake job interviews led to $6.3 billion theft

Binance Holdings Ltd. released a detailed report on Tuesday revealing that hackers stole $6.3 billion from its platform using fake job interviews and malicious code. The company attributed the breach to North Korea, describing it as a multi-stage campaign that targeted its engineering staff through social engineering tactics.

According to the report, one engineer was contacted via a job platform by a person posing as a project director. The candidate then interviewed with an individual claiming to be the CEO of a fictional company over a social chat app. During the interview, the engineer was asked to download an assignment containing a malicious code repository. This action triggered a series of unauthorized activities that allowed the attackers to infiltrate the network.

Richard Teng, co-chief executive officer of Binance, stated that the incident was not a single error but a campaign built over many months. He noted that the attackers combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques to gain control.

Nine days before the hack, attackers accessed the laptop of the targeted employee and used it to infiltrate the computers of two other software engineers who worked on Binance’s digital wallets. The report states that the hackers used an internal AI tool to gain access, though the company did not specify how that tool was used to control the laptops. One of those engineers had accidentally downloaded malicious software in June while installing a popular AI coding tool, which exposed their role and the roles of their colleagues to the attackers.

In the hours following the exploit, first reported on Oct. 29, stablecoin giants Tether and Circle Internet Group Inc. froze nearly $3 billion in funds to stop the hackers from moving the money. Analytics firms tracked the flow of crypto and attributed the exploit to North Korea, a charge the country has denied. Some traders capitalized on the resulting market turbulence.

Binance paused withdrawals for almost two days after the incident before progressively allowing users to take out funds on Sunday. The company initially saw billions in outflows, but by Tuesday, hourly deposits had started exceeding hourly withdrawals. Binance said it has almost replenished the stolen cryptocurrency using money from its corporate treasury and two insurance funds. The exchange is also working with US law enforcement, including the FBI, the US Secret Service, and the Justice Department.

The report noted that in 2026, Binance identified and prevented 57 attempted attacks from hackers connected to North Korea. The company has implemented mitigation measures, including rebuilding affected infrastructure and redeveloping its internal AI tool. Despite the breach, Bitcoin fell more than 4% to nearly $76,000 initially but has since recovered to trade at around $77,200 on Tuesday.