A Fake Job Interview, a Malicious Download and the Biggest Crypto Hack in History: Binance Loses $6.3 Billion - Sify News

The world's largest cryptocurrency exchange, Binance, lost approximately $6.3 billion to what the FBI believes was a North Korean state-sponsored ransomware gang. The attack wasn't executed with advanced hacking tools but through months of deception that began with a fake job interview.

According to details shared by Binance, one of its software engineers fell for a ruse involving a fake job interview. The engineer downloaded what they believed to be a coding assignment for the pretend role, which actually contained malware. This initial compromise allowed hackers to access Binance's internal systems and eventually its wallets.

Months-long deception

The attack unfolded over several months, starting in June 2026 when a Binance employee downloaded malicious software while searching for a development tool. The malicious version appeared first in search results due to an ad. Despite Binance's security team detecting the breach and taking containment measures, the hackers learned details about the employee's role and colleagues working on wallet infrastructure.

The attackers used a legitimate recruiting service to contact an engineer, pretending to be a director at a hiring company. During a video call, the engineer spoke with what they thought was a recruiter and later someone claiming to be the organization's CEO. The supposed HR representative shared a social media account with personal photos and videos to make the operation convincing.

AI tool exploited

On October 20, the attackers used a compromised employee device and an internal AI tool to hack into computers of two software engineers with roles related to Binance's wallets. Binance clarified that the AI tool wasn't simply used to generate phishing emails or malicious code. On October 29, using stolen credentials and malicious code, the attackers accessed Binance's wallet infrastructure and began transferring billions in crypto assets.

Massive theft

In total, the attackers stole crypto assets worth $6.34 billion, mostly from Binance's hot wallets connected to the internet. The bulk of the attack occurred in just 20 minutes, though Binance took around four hours to stop all unauthorized transfers. According to TRM Labs, five different Binance wallets sent 233.46 million XRP coins in four minutes, while a bitcoin hot wallet transferred 18,270 BTC (worth $1.47 billion). Ethereum theft totaled approximately $3.79 billion.

The hackers used an advanced Ethereum feature called EIP-7702, allowing smart contracts to temporarily control transactions for standard wallets. They granted smart contracts control over the wallets, enabling fund transfers to addresses they controlled outside Binance's usual withdrawal system. As of November 3, Binance had frozen $2.85 billion worth of stolen crypto assets with partner assistance.

Aftermath

Binance has frozen most of the stolen funds and won't make customers pay for the hack. As of November 3, the exchange had topped up approximately 98% of affected assets with its own funds. The company announced increased investment in AI-driven threat detection and plans to establish a security research fund.

Customers reportedly withdrew $3.64 billion from Binance following news of the hack, though withdrawals have since stabilized. The hack dwarfs previous crypto exchange attacks, including the $1.5 billion Bybit breach in February 2025, and has further shaken confidence in cryptocurrency security.