Shocking Details On the Binance Hack: Fake Job Interviews and Months of Access

A fake job interview helped hackers steal $6.3 billion from Binance. The attackers spent months infiltrating the exchange, using tactics that other cryptocurrency companies had warned about long before the breach.

On November 3, Binance revealed that the October 29 attack began with two engineers whose computers were compromised separately.

The first incident happened in June, when an engineer downloaded a tampered software package while searching for an AI tool. 

Binance detected the infection, replaced the computer and changed credentials. However, the attackers had already gathered information about the employee and the wallet team.

Then came the fake interviews.

https://t.co/sU9dUqLQDH

— Binance (@binance) November 3, 2026

Job Scam Cost Binance Over $6 Billion

In September, another engineer was approached through a legitimate recruitment platform. The supposed employer arranged video interviews with an HR representative and someone posing as its CEO.

Eventually, the engineer received a coding assignment. The downloaded files contained malware that bypassed the computer’s security software.

By October 20, the attackers had used the compromised computer and an internal AI tool to reach other Binance engineers.

They subsequently stole deployment credentials and used them to introduce malicious software into Binance’s wallet infrastructure.

On October 29, fraudulent withdrawals began. Within hours, approximately $6.3 billion was stolen.

Binance says roughly $2.85 billion has been frozen and 98% of affected tokens replenished using company funds.

Other Exchanges Had Already Warned About These Attacks

The recruitment tactic was already well documented.

In May 2025, Kraken exposed a suspected North Korean operative attempting to join its engineering team.

Coinbase disclosed another suspected infiltration case in August 2026, explaining how unusual activity helped it identify a potentially compromised contractor.

Even more directly, Microsoft warned in March that North Korean-linked hackers were using fake coding interviews to infect developers’ computers.

REVEALED: British companies are unwittingly funding North Korea’s nuclear programme, a Telegraph investigation can reveal.Posing as legitimate remote workers, Kim Jong-un’s army of approximately 100,000 operatives sends job applications en masse and uses deceptive tactics to… pic.twitter.com/vgQo7aZPyO

— The Telegraph (@Telegraph) October 31, 2026

Why Didn’t Binance Stop It?

Three security questions now demand answers.

First, why could an employee run an untrusted coding assignment on a computer connected to corporate systems?

Second, why did the June infection remain consequential after Binance detected and addressed it?

Third, how could stolen deployment credentials ultimately give attackers access to systems authorizing billions in withdrawals?

Binance has not explained which safeguards failed or whether earlier industry warnings had prompted additional protections.

The FBI has attributed the theft to North Korea’s TraderTraitor group.

For Binance, the central question is how a known recruitment scam eventually reached the infrastructure protecting billions in customer assets.