Binance: Fake Job Interviews Opened the Door to $6.3bn Hack

Made possible by our supporters

The biggest crypto theft on record started with a job offer. Binance, the largest cryptocurrency exchange, says hackers took $6.3bn (£4.7bn) after tricking one of its engineers with fake interviews.

The North Korea question

US agencies, including the FBI and Secret Service, are helping trace the stolen funds. They and several cyber analysts say the hack carries the marks of a North Korean operation.

Pyongyang denied it on Tuesday. Kim Yo Jong, a senior official and the sister of leader Kim Jong Un, called the accusation a US attempt to damage her country's image. Binance said the FBI's latest information indicates North Korea is responsible.

The TraderTraitor unit, also known as the Lazarus Group, was blamed for a then-record $1.5bn hack of Bybit in 2025.

Withdrawals frozen and money traced

Binance suspended withdrawals globally. Customers could not take their crypto out until service was restored on Sunday. The company apologised and said "this should not have happened."

It is working with law enforcement to trace and freeze affected assets. It says it has set aside more than 100% of the funds needed to cover the loss, and that 98% of the affected token assets had been replenished as of Saturday.

How the attack worked

The company published initial findings and described a multi-stage campaign it called sophisticated. Hackers targeted engineers with social engineering, which means tricking people into handing over access or details instead of breaking in directly.

One engineer was approached through a legitimate job-hunting platform. He was invited to bogus interviews with fake company representatives. The attackers built trust with more deceptive methods, including sharing social media accounts that held personal images.

In a second interview he was told to download an "assignment." It was malware, and its code used obfuscation techniques to avoid detection.

In October, Binance says, the attackers used his compromised computer and a compromised internal AI tool to take over the laptops of two other engineers. From there they drained the exchange's wallets.

Our View

Hiring is the weak point this attack exploited. A recruiter message or a take-home test can carry the same risk as a phishing email, and engineers with deep system access are the obvious target. Binance plans more spending on AI tools that detect threats and a third-party review, yet one of the tools used against it was its own AI tool. How that tool was compromised is not explained.

Source: BBC News