Binance hackers used fake job interview in US$6.3 billion attack

Hackers used a bogus job interview and software hidden in an advertisement ⁠to compromise the ⁠computers of two Binance software engineers before using a third's computer to drain US$6.3 billion ($9 billion) worth of crypto in last week's record heist, the exchange said.

In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking endeavour that began in June and set off a series of security breaches culminating in ‌the theft last week.

Even as Binance scrambled to lock down its system and freeze ‌withdrawals ‌after detecting the attack, the hackers were still making off with crypto ‌from the exchange nearly four hours after the first theft, Binance said. 

The FBI has blamed ⁠a North Korean hacking group, a claim North Korea has rejected. 

Binance has said it is repaying all customers whose funds were stolen.

The attack has raised questions about how hackers breached the world's largest crypto exchange after years of North Korea-linked attacks, which have grown in ambition and frequency, and renewed questions about the vulnerability of digital assets to cybercrime.

Cyber security ​experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest, said Michael Barnhart, a researcher with cyber security firm DTEX. 

Fake job ⁠interviews are a well-known hacking technique.

Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. That shows Binance is “just getting barraged,” Barnhart said.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in its report.

Left exposed

Binance said the attack began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with.

The exchange said it detected this afterwards, replaced the device and changed credentials, but the employee's role and those of others on the wallet team were exposed.

A person familiar with the incident said the tool's malicious version had been placed in an advertisement, which meant it ​appeared higher in a search engine than the real version.

Then in September, ⁠a second software engineer seeking a new job downloaded a "malicious code repository" onto the person's ⁠computer after interviewing for what they thought was a legitimate role, including meeting virtually with the CEO of a fictitious company, Binance's report said.

On October 20, ​the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer's system and that of a ‌second wallet developer.

Nine days ⁠later, the attacker used the second wallet developer's computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.

A limited number of engineers at the company have direct access to wallets — which store or trade crypto — the person familiar with the hack said.

Cryptocurrency removed in minutes

The ‌attack unfolded quickly on October 29, removing 233.46 million XRP — a cryptocurrency — from five Binance hot, or internet-connected, wallets to an attacker-controlled address in just four minutes, before attackers withdrew other cryptocurrencies including bitcoin, the exchange said in its report.

Binance said it received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised ​permissions, resulting in about US$2.85 billion of frozen assets, but suspending withdrawals alone could not stop all unauthorised asset movements.

Attackers used 50 signing transactions to manipulate the account, while Binance said it was forced to build new procedures to revoke authorisations, slowing its response. 

The final unauthorised transfer was at 2356 GMT, Binance said, nearly ‌four hours after the ⁠attack began.

Binance said as a result of the hack, ​it was increasing investment in AI-enabled detection and working on establishing a security research fund and targeted initiatives with leading AI companies.