Binance Says Hackers Stole $6.3B After Targeting Employees With Fake Job Offer

Binance says hackers used fake job interviews, malicious software, and compromised internal systems to carry out a $6.3 billion cryptocurrency theft, exposing security risks across digital asset infrastructure.

For more news, click here

Cyberattacks against cryptocurrency exchanges increasingly target the people and development tools behind digital asset systems, rather than relying solely on weaknesses in blockchain networks. Fraudulent recruitment approaches and compromised software can give attackers access to internal credentials long before suspicious transactions appear.

Binance says a months-long intrusion involving both techniques led to the theft of approximately $6.34 billion in digital assets on October 29. In an initial investigation published November 3, the exchange described how attackers moved from employees' computers into the systems responsible for authorizing wallet transactions.

The attack involved a fake job interview, a malicious developer installation, and an internal artificial intelligence tool. Binance said its findings remain preliminary and will undergo independent security review.

From Fake Interviews to Wallet Access

According to Binance's incident report, the campaign began in June when a wallet operations engineer downloaded a tampered software installer while trying to set up an AI coding tool. The company detected suspicious activity, replaced the computer, and changed associated credentials. However, the attackers had already learned details about the engineer's role and colleagues.

In September, another engineer was approached through a legitimate recruitment platform by someone posing as a company representative. After two interviews, including one with a supposed chief executive, the employee was asked to download a coding assignment. The repository contained malware that executed during setup and avoided the security tools protecting the device.

By October 20, the attackers had used the compromised computer and an internal AI tool to access two additional engineers' systems. They discovered deployment permissions and credentials that could be used to reach Binance's wallet infrastructure.

On October 29, the attackers used those permissions to deploy malicious software and gain access to an internal wallet-signing service. The incident illustrates how seemingly separate employee-level compromises can be combined into a much larger intrusion.

Why the Theft Continued After Withdrawals Were Suspended

Binance said five hot wallets transferred 233.46 million XRP to an attacker-controlled address in four minutes. Further unauthorized movements involved Bitcoin, Solana, Optimism, and Ethereum-related assets.

The exchange began investigating unusual transfers and suspended withdrawals. But the attackers had also exploited Ethereum's EIP-7702 authorization mechanism, which allows an account to delegate certain execution rights to a smart contract.

According to Binance, the malicious permissions remained active on-chain, independently of its normal withdrawal systems. The use of a multi-party computation wallet further complicated the process of revoking those permissions. The final unauthorized transfer was confirmed nearly four hours after the first XRP movements.

As of its November 3 update, Binance said approximately $2.85 billion in assets had been frozen or intercepted. It also reported that 98% of affected token assets had been replenished as of October 31, with the company covering customer losses. These figures describe recovery and reimbursement measures, not additional amounts stolen.

Attribution and the Broader Security Challenge

The FBI attributed the October 29 theft to North Korean cyber actors it identifies as TraderTraitor. North Korea rejected the allegation. Binance separately said it had detected and prevented 57 suspected North Korea-linked threats during 2026, including attacks involving fraudulent interviews and malicious developer tools.

Binance says it has rebuilt affected systems, revoked compromised credentials, strengthened wallet controls, and expanded AI-based threat monitoring. It is also commissioning an independent cybersecurity review and considering a security research fund.

For the wider cryptocurrency industry, the incident highlights a risk that wallet security alone cannot address. Exchanges also need to secure developer environments, restrict sensitive permissions, verify software sources, and ensure that emergency controls can stop unauthorized transactions across both internal systems and on-chain mechanisms.

The effectiveness of Binance's changes will depend on what the independent investigation finds and how quickly similar attack paths can be detected and contained.