Hackers used fake job interviews in $6.3bn Binance theft

Binance says hackers staged fake recruitment calls and other sophisticated tactics to enable a $6.3 billion heist on 29 October.

The attack is attributed to a North Korean group known as TraderTraitors, which infiltrated the cryptocurrency exchange’s systems after months of preparation.

In June, a Binance engineer downloaded a modified file that exposed sensitive information, though the breach was later fixed. In September, another engineer was contacted through a legitimate job‑hunting platform by someone posing as a project director, leading to a series of fake interviews that built trust.

During the second interview, the engineer was instructed to download a file containing zero‑day malware onto his work computer. The malicious code evaded Binance’s security tools and was later used, nine days before the main attack, to gain control of the first engineer’s device and that of a third employee.

The compromised computers allowed the hackers to withdraw billions of dollars, prompting a rapid customer response that saw roughly $3.6 billion withdrawn from the exchange. As of 3 November, Binance had frozen about $2.85 billion in digital assets and pledged to cover the losses, setting aside more than 100 percent of the required funds.

Binance added that its security team detected and prevented 57 suspected North Korea‑linked cyber‑threat cases throughout 2026, underscoring the ongoing risk from state‑sponsored actors.

Source: Silicon Republic. Photo: panumas nikhomkhai / Pexels.