Binance Says Its $6.3 Billion Hack Began With a Fake Job Interview and a Malware-Laced Coding Test

Binance, the world's largest cryptocurrency exchange, said Tuesday that the $6.3 billion theft from its wallets last month began with fake job interviews in which an engineer was persuaded to download malware disguised as a coding assignment, according to the BBC, TechTarget and Reuters.

Binance called it a "serious and highly sophisticated security incident" and apologized, saying "this should not have happened," the BBC reported. "We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company said.

How the company says it happened

According to Binance's preliminary investigation, as described by TechTarget, the campaign traced back to June, when a wallet engineer downloaded a tampered Homebrew installer while looking for an AI coding tool. Binance replaced the device and rotated credentials, but information about that engineer and wallet-team colleagues had already been exposed.

In September, another engineer was contacted through a legitimate job-hunting platform and invited to interviews with representatives of a fictitious company, Binance said, according to the BBC. Fortune reported that Binance executives identified the platform as LinkedIn, TechTarget said. A purported HR representative shared personal social media content to build trust, and a later interview involved someone claiming to be the company's CEO.

During a second interview, the engineer was told to download an "assignment" that contained malware using "obfuscation techniques" to evade detection, the BBC reported. Binance said the malware ran during installation and escaped endpoint detection, according to TechTarget.

On Oct. 20, the attackers used the compromised computer and an internal AI tool to reach two other engineers' devices and find a deployment token, Binance said, according to TechTarget. The theft was triggered on Oct. 29.

The attackers moved 233.46 million XRP from five internet-connected "hot" wallets in four minutes and kept removing assets for nearly four hours, according to the 10 Things global news digest's summary of the findings. Binance froze about $2.85 billion in assets.

North Korea

U.S. agencies including the FBI and the Secret Service have helped trace the stolen crypto, and they and outside analysts said the attack bore signs of North Korean involvement, the BBC reported. On Tuesday, Binance wrote on X: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, called the accusations another "sinister attempt" by the United States to damage the country's image, according to the BBC. North Korea has consistently denied responsibility for major cyberattacks attributed to it. Its TraderTraitor unit, also known as the Lazarus Group, was blamed for the then-record $1.5 billion theft from the exchange Bybit in 2025.

Customers and repairs

Binance suspended withdrawals for customers worldwide after the theft and restored them Sunday, the BBC reported. The company said it set aside more than 100 percent of the funds needed to cover the loss and that 98 percent of the affected token assets had been "replenished" as of Saturday.

Binance said it has rebuilt affected wallet systems and internal AI tools, replaced devices and disabled credentials, and plans an independent cybersecurity review, TechTarget reported. The company also said it would invest more in AI threat-detection tools and set up a security research fund, according to the BBC.

What security researchers said

"While using a work computer for an external coding assessment warrants its own scrutiny, the larger concern is how that compromise enabled access to other systems and sensitive financial infrastructure," said Gina Cardelli of the cybersecurity company Fortra, according to TechTarget.

"Once attackers know who holds the keys, they often go after those people directly, and a recruiter's pitch is one of the few approaches a target is likely to welcome without suspicion," said Rohan Gupta, chief executive of Diopter. "Security teams should treat recruiting outreach to those engineers as part of the attack surface and keep interview code off any machine near production."

TechTarget noted that Binance's account does not establish that the attackers used AI-generated voices or video.

What is not known

Binance described the findings as preliminary. How much of the stolen crypto beyond the frozen amount can be recovered, and whether anyone will be charged, had not been announced.