Binance Hack Began with Fake Job Interviews, Ended with $6.3 Billion Stolen

Binance has revealed that a months-long cyberattack culminated in the theft of $6.3 billion in digital assets. The sophisticated campaign began in June when attackers compromised an engineer's computer through a tampered version of Homebrew, a software package manager. The employee had downloaded it after clicking an online advertisement while searching for an AI coding tool.

Although Binance detected the suspicious activity, replaced the employee's device, and changed affected credentials, the attackers had already gathered information about the engineer and other wallet development team members. This marked just the beginning of a carefully orchestrated breach that would eventually drain the exchange's hot wallets.

Fake Job Interviews

In September, the hackers escalated their approach by targeting another engineer through a job-hunting platform. They posed as representatives of a fictitious company and arranged interviews with individuals claiming to be its executives. During this process, the engineer received a coding assignment containing malicious software.

The compromised devices provided the attackers with further access to Binance's internal systems. On October 20, they used an internal AI tool and information from the compromised computers to access systems belonging to two wallet developers, moving closer to their ultimate goal.

Wallet Drain

The attack escalated on October 29 when the hackers used stolen credentials to deploy a container and run a malicious script. They exploited Ethereum's mechanism to obtain execution permissions over a Binance hot wallet, allowing them to initiate unauthorized transactions. The attackers first moved approximately 233 million XRP from five internet-connected wallets.

They then expanded their operation to target wallets across multiple blockchains, ultimately stealing approximately $6.3 billion in digital assets. The scale of the theft represents one of the largest cryptocurrency heists in history.

North Korea Connection

The FBI has attributed the attack to TraderTraitor, a hacking group linked to North Korea. This group has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025. North Korea has denied involvement, with Kim Yo Jong, sister of leader Kim Jong Un, describing the FBI's attribution as a political provocation.

Binance reported detecting and blocking 57 suspected North Korea-linked cyberattacks in 2026 alone, many of which involved fraudulent recruitment approaches and malicious software similar to those used in this breach.