Binance's $6.3 Billion Hack Began With a Fake Job Interview

By Olivia Hart

Hackers stole a record $6.3 billion (£4.7 billion) from Binance after luring one of its engineers into fake job interviews and planting malware disguised as a work assignment, the company has revealed. The theft is thought to be the largest crypto hack to date — more than four times the $1.5 billion taken from exchange Bybit in 2025.

Binance, which operates the world's largest cryptocurrency exchange, published initial findings describing a "sophisticated, multi-stage campaign." It called the breach a "serious and highly sophisticated security incident" and apologised, saying "this should not have happened."

That apology, notably, arrives after one of the costliest security failures in the industry's history. The question is what the disclosure actually changes.

How did the attackers get in?

According to Binance's post on X, hackers targeted its engineers with social engineering — techniques such as phishing that trick people into handing over sensitive details.

The sequence, as Binance tells it:

• One engineer was contacted through a legitimate job-hunting platform and invited to interviews with fake company representatives.
• The perpetrators used "more advanced and deceptive" methods to build trust, including social media accounts containing personal images.
• During a second interview, the engineer was told to download an "assignment" that was in fact malware, deploying malicious code with "obfuscation techniques" that evaded detection.
• In October, hackers leveraged that compromised computer plus a compromised internal AI tool to seize control of two other engineers' laptops and execute the next stages of the attack.

Malware, in plain terms, is software designed to damage or exploit a system — and here it routed around detection tools entirely. In short: the weakest point was not the code, but a person on the payroll.

Who does Binance blame?

The FBI and the US Secret Service have been assisting Binance in tracing cryptocurrency taken from the platform's own wallets. Those agencies, along with a range of cyber analysts, said the hack bore the signs of North Korean orchestration.

Binance had previously declined to answer BBC queries about North Korea's alleged role. On Tuesday, the company changed course, writing: "The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident."

Pyongyang denies it. Kim Yo Jong, a top DPRK official and sister of leader Kim Jong Un, called the accusations another "sinister attempt" by the US to damage North Korea's public image. The country has consistently denied the major cyber attacks attributed to it in recent years.

Analysts have previously blamed the TraderTraitor unit, also known as the Lazarus Group, for the $1.5 billion Bybit hack in 2025. A denial from Pyongyang, it should be said, is a routine feature of these cases, not evidence either way.

What happened to customers' money?

The breach forced Binance to suspend withdrawals globally. Users could not move their cryptocurrency off the platform until service was restored on Sunday — after which they pulled out billions of dollars in assets.

"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," the company said.

Binance says it has taken remedial steps:

• Working with law enforcement to trace and freeze affected assets.
• Setting aside more than 100% of the funds needed to cover the loss.
• Reporting that 98% of impacted token assets had been "replenished" as of Saturday.

A full reserve is a promise on paper until customers test it in practice, and the billions withdrawn after reopening suggest many intend to do exactly that.

What changes now?

Binance said it will increase investment in AI tools that detect security threats and engage third-party cyber experts for a full-scale review of the incident. It also plans to establish a security research fund and work with leading AI and security firms on targeted initiatives.

Notably absent from the announcement: any detail on who inside the company approved the affected tooling, or what accountability follows. The takeaway for the industry is blunt — a fake recruiter with a convincing social media presence was enough to breach the world's largest exchange, and the reforms announced so far address detection more than they address people.