GLOBAL
North Korean hackers steal $6.3 billion from Binance in fake job interview cyberattack
State-backed hackers spent months staging fake recruitment interviews and embedding malware in developer tools to breach internal crypto wallet controls.
Hackers stole $6.3 billion from cryptocurrency exchange Binance on 30 October 2026 in what stands as the largest crypto heist on record, infiltrating internal systems through a campaign that relied on fake job interviews and malicious software disguised as developer tools.
The FBI and blockchain investigators attributed the breach to TraderTraitor, a North Korean state-sponsored hacking group previously linked to a $1.5 billion heist at crypto exchange Bybit last year. Binance confirmed the attribution in a security report published on 3 November 2026, stating that the breach involved a multi-stage campaign targeting software engineers on its wallet team.
Why it matters
For enterprise operators and financial technology founders, the Binance exploit demonstrates how vulnerable core infrastructure remains to targeted social engineering. Despite automated detection tools and hardware replacement protocols, attackers exploited human recruitment channels to bypass access controls.
The heist highlights that endpoint protection and privilege credentials can be compromised when attackers spend months conducting targeted social engineering against employees holding critical system permissions.
How the attack unfolded
Preparations for the heist began in June 2026 when a Binance software engineer downloaded a tampered installation of Homebrew while searching for a popular AI coding tool on a search engine, according to Binance's security report. The compromised download installed password-stealing malware on the engineer's device.
Although Binance detected the suspicious activity and replaced the engineer's laptop, the attackers used stolen credentials to identify colleagues on the exchange's wallet infrastructure team.
In September 2026, the hackers launched a targeted recruitment campaign. Posing as hiring recruiters, the attackers contacted another software engineer on Binance's wallet team and conducted two job interviews. Following the interviews, the engineer was asked to complete a coding exercise as part of a technical assessment.
The assignment contained hidden malware designed to evade internal security controls. When opened on the engineer's work-issued laptop, the malicious code compromised the device without triggering security alerts.
Once inside the network, the attackers accessed an internal AI tool to navigate across systems and compromise the workstation of a third engineer who held administrative access to wallet transaction infrastructure.
"This was not a single mistake or a single breach. It was a campaign built over many months," Richard Teng, co-chief executive officer of Binance, said. Teng told reporters that attackers "combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques" to obtain permissions capable of authorizing wallet transactions.
| Attack Metric / Event | Detail / Value | Source |
|---|---|---|
| Total Stolen Funds | $6.3 billion | Binance Statement |
| Attributed Group | TraderTraitor (North Korea) | FBI Announcement |
| Prior Bybit Heist | $1.5 billion | FBI Announcement |
| Historical Attacks Faced | 57 suspected North Korean attempts | Binance Statement |
| Initial Breach Vector | Tampered developer download (June 2026) | Binance Security Report |
| Secondary Breach Vector | Fake job interview assignment (September 2026) | Binance Security Report |
Diplomatic fallout and denial
The North Korean government disputed the FBI's findings. Senior North Korean official Kim Yo Jong issued a statement on 3 November 2026 calling the US announcement a "trite provocation" and describing the allegations as an extension of hostile policy toward Pyongyang.
On 4 November 2026, North Korea fired multiple missiles toward its eastern waters, according to South Korea's Joint Chiefs of Staff. The missile launches occurred hours after Pyongyang declared it had no intention of resuming diplomatic talks with Washington.
What happens next
Following the theft, Binance suspended customer withdrawals across its network. The company stated that it has since rebuilt its affected wallet infrastructure, overhauled internal AI tools, replaced compromised devices, and revoked credentials associated with the targeted engineers.
Binance has commissioned an independent cybersecurity firm to review its network architecture and internal defenses. "We’re working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds," Teng said. Federal agencies and blockchain analytics firms continue to track the movement of the stolen assets across digital networks.