Binance Confirms $6.3 Billion Heist Began With a Fake Job Interview

North Korean hackers stole a record $6.3 billion in cryptocurrency from Binance last week, the world's largest crypto exchange confirmed in an updated statement posted on X on Tuesday. The company suspended customer withdrawals across its network following the breach.

The FBI and blockchain investigators have blamed North Korea, a country long accused of massive cryptocurrency thefts used to fund its internationally sanctioned nuclear weapons program. Binance says the intrusion started with a fake recruiter and a poisoned coding assignment.

How did the hackers get in?

According to Binance's statement, North Korean hackers posing as recruiters contacted a software engineer who works on wallets at the company. After two interviews with the purported employer, the engineer was told to download what looked like a coding assignment. The file contained malicious code that compromised the engineer's work-issued laptop. Binance said its security tools did not detect the malware.

That single foothold set off a chain reaction:

• Hackers used the infected laptop to access an internal tool capable of taking over the work computers of two other engineers on the wallet team.
• One of those engineers had unwittingly downloaded a tampered app months earlier — password-stealing malware — after finding the software through search engine results.
• Binance replaced that engineer's compromised laptop, but the attackers had already stolen the engineer's credentials.
• Those credentials let them break into the computer of a third engineer, whose role granted access to systems controlling billions of dollars in crypto.

Binance said the attack "should not have happened," and that it had improved its network security following the theft. Spokesperson Ross O'Leary referred to the company's public statement but declined to answer questions on the record about the incident — including how Binance prevents unauthorized code from running on employee laptops, if at all, and whether third parties had audited its network before the hack.

The heist remains the largest theft of crypto in history.

Wasn't this preventable?

Researchers have warned for years. North Korean hackers routinely pose as venture capitalists, investors and recruiters, using dossiers of stolen American identities to trick employees into granting system access. The U.S. government and major cybersecurity firms have issued repeated warnings, and the tactic is widely known across the crypto industry.

The scale is measurable: roughly half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. And Binance itself counted at least 57 suspected attacks from North Korea, which it said reflect the "persistent threat posed by state-sponsored actors targeting the cryptocurrency industry."

Two questions will likely drive investigators' attention: how the hackers persuaded the engineer to download malware despite the highly publicized threat, and how they bypassed weaknesses in Binance's own network. The case exposes social engineering — employment offers in particular — as a core North Korean playbook. But analysts note the ultimate responsibility sits with the company: it must ensure its systems cannot run unauthorized or untrusted software that could cause a compromise.

What happens next?

Binance said it will bring in outside cybersecurity experts to review the incident and has already put new security measures in place to prevent a repeat. Until that review reports, the gap between 57 known attack attempts and one catastrophic success is the number that will define the industry's response.