Binance says fake job interviews used as part of $6.3bn crypto hack

Cryptocurrency exchange Binance has revealed that hackers utilised a sophisticated campaign involving fake recruitment interviews and compromised internal artificial intelligence tools to orchestrate a massive digital asset heist, according to initial findings published by the firm. The security breach resulted in the theft of a record $6.3bn (£4.7bn) from the platform's wallets, marking what is widely believed to be the largest cryptocurrency hack in history and drawing intense scrutiny to the business operations of centralised trading platforms.

The multi-stage breach began months prior to the final assault. According to Binance's disclosures, the groundwork started in June when an engineer inadvertently downloaded a tampered version of Homebrew—a package manager for macOS and Linux—after clicking an internet ad while searching for an AI coding tool. Although the platform detected the initial malicious download and rotated credentials, the incident exposed critical information regarding staff roles within the wallet developer team. By September, attackers shifted tactics by targeting another engineer through a legitimate job-hunting platform, using posing as a project director and a fictitious company chief executive to conduct bogus video interviews.

Media additions

Binance says fake job interviews used as part of $6.3bn crypto hack

Escalation and Internal AI Exploitation

During the second interview, the targeted employee was instructed to download a coding assignment containing hidden malware designed to evade endpoint security detection. On 20 October 2026, the perpetrators leveraged this compromised machine alongside a compromised internal artificial intelligence tool to seize control of additional laptops belonging to a wallet DevOps engineer and another software engineer. Using stolen container deployment permission tokens and credentials, the attackers triggered malicious scripts to drain the exchange's hot wallet infrastructure across multiple blockchains.

Binance co-CEO Richard Teng rejected theories of a simple single point of failure during media appearances, emphasising that the incursion involved complex lateral movement across internal systems rather than a straightforward one-click compromise. To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single 'one-click' action, Teng noted regarding the multi-layered attack process.

Attribution and International Response

Following the breach, the Federal Bureau of Investigation (FBI) and the US Secret Service assisted in tracing the stolen funds. On Saturday, the FBI formally attributed the cyber attack to TraderTraitor, a state-sponsored North Korean hacking unit also known as the Lazarus Group. Law enforcement observed hackers converting stolen holdings into Ethereum in preparation for further laundering via decentralized finance and instant swap services. The hack eclipses previous major incidents, such as the $1.5bn Bybit exchange heist from the previous year.

Pyongyang vehemently rejected the allegations. Kim Yo Jong, a senior official of the Democratic People's Republic of Korea and sister of leader Kim Jong Un, dismissed the accusations as a sinister attempt by the United States to damage the nation's public image. Meanwhile, US President Donald Trump told reporters that federal authorities were still unsure who the culprits are.

Recovery, Withdrawals, and Asset Replenishment

In the wake of the disaster, Binance suspended customer withdrawals globally to protect remaining assets. The suspension triggered heavy panic, prompting users to withdraw billions of dollars in digital currency once services were restored. Stablecoin issuers Tether and Circle, along with Ripple, moved quickly to freeze billions of dollars in associated assets. Depending on the reporting update, Binance stated that it had replenished between 90% and 98% of the affected token assets using corporate treasury resources, futures insurance funds, and the Secure Asset Fund for Users (SAFU), pledging to absorb the financial impact rather than passing losses to customers.

The incident has heightened anxiety across the digital asset sector, with founders warning users to remain vigilant against secondary phishing campaigns and fraudulent compensation offers.

What Happens Next

Binance has announced plans to implement stricter internal access controls, rebuild its wallet architecture in secure new environments, rotate compromised credentials, and expand investment in AI-driven threat detection systems. The company will also engage independent third-party cybersecurity experts to conduct a full-scale review of the incident and establish a dedicated security research fund. Further technical post-mortems and law enforcement freezing operations are expected as investigations continue.