Shocking Details On The Binance Hack: Fake Job Interviews And Months Of Access

What Happened

A fake job interview helped hackers steal $6.3 billion from Binance. The attackers spent months infiltrating the exchange, using tactics that other cryptocurrency companies had warned about long before the breach.

Eventually, the engineer received a coding assignment. The downloaded files contained malware that bypassed the computer’s security software.

They subsequently stole deployment credentials and used them to introduce malicious software into Binance’s wallet infrastructure.

Even more directly, Microsoft warned in March that North Korean-linked hackers were using fake coding interviews to infect developers’ computers.

Market Context

On November 3, Binance revealed that the October 29 attack began with two engineers whose computers were compromised separately.

The first incident happened in June, when an engineer downloaded a tampered software package while searching for an AI tool.

Why It Matters

In May 2025, Kraken exposed a suspected North Korean operative attempting to join its engineering team.

First, why could an employee run an untrusted coding assignment on a computer connected to corporate systems?

Third, how could stolen deployment credentials ultimately give attackers access to systems authorizing billions in withdrawals?

Details

Binance detected the infection, replaced the computer and changed credentials. However, the attackers had already gathered information about the employee and the wallet team.

Then came the fake interviews.

Job Scam Cost Binance Over $6 Billion

In September, another engineer was approached through a legitimate recruitment platform. The supposed employer arranged video interviews with an HR representative and someone posing as its CEO.

By October 20, the attackers had used the compromised computer and an internal AI tool to reach other Binance engineers.

On October 29, fraudulent withdrawals began. Within hours, approximately $6.3 billion was stolen.

Binance says roughly $2.85 billion has been frozen and 98% of affected tokens replenished using company funds.

Other Exchanges Had Already Warned About These Attacks

The recruitment tactic was already well documented.

Coinbase disclosed another suspected infiltration case in August 2026, explaining how unusual activity helped it identify a potentially compromised contractor.

Why Didn’t Binance Stop It?

Three security questions now demand answers.

Second, why did the June infection remain consequential after Binance detected and addressed it?

Binance has not explained which safeguards failed or whether earlier industry warnings had prompted additional protections.

The FBI has attributed the theft to North Korea’s TraderTraitor group.