Binance Details $6.3B Hack Tied to Fake Job Interview

Binance says attackers stole more than $6.3 billion in digital assets after using a fraudulent job interview, malware and compromised internal AI tooling to reach its wallet infrastructure. The exchange says it has frozen or intercepted about $2.85 billion and replenished 98% of impacted assets.

The attack unfolded over months. Binance says an engineer was first targeted in June through a tampered Homebrew installation downloaded while installing an AI coding tool. In September, attackers posed as company executives during a fake recruitment process and tricked another employee into downloading a malicious coding assignment. On Oct. 20, they used the compromised computer and an internal AI tool to access two engineers' devices and discover a container deployment permission. Nine days later, stolen credentials were used to deploy a container and run a script that launched the wallet attack.

Why it matters

The incident shows how social engineering can turn routine developer workflows and AI tools into paths toward sensitive infrastructure. Binance said the attackers used compromised credentials to access wallet-signing systems and authorize unauthorized transactions. The FBI linked the attack to North Korea, while Kim Jong-un's sister called that allegation a “grave political provocation.”

Binance co-CEO Richard Teng described the incident as a months-long campaign and said the exchange was publishing its report because the lessons extend beyond Binance. The company says it closed the entry points, rebuilt or replaced affected systems, strengthened device controls and expanded AI-based behavioral anomaly detection.

Market impact

Binance says it detected and prevented 57 suspected North Korea-linked cyberattacks throughout 2026, many involving fraudulent interviews, malicious developer tools and social engineering. The disclosure puts employee-device security and wallet controls under scrutiny across crypto firms.

Separately, Binance reopened withdrawals in phases for dozens of assets across BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, TRON and Base, starting at 4 a.m. UTC on Nov. 3.