Fake Interviews, a Poisoned Installer: How $6.3 Billion Left Binance

Binance lost $6.3 billion in a hack that started with a LinkedIn message, a fake job interview and a software download no engineer should have trusted.

The exchange disclosed on Tuesday that North Korean hackers combined social engineering with malicious software to carry out last week's theft, the biggest in crypto history. Company executives, speaking to reporters, said the attackers targeted a Binance engineer on LinkedIn and staged a series of fake job interviews to persuade the employee to download an "assignment" that opened a door into Binance's systems.

How did the fake recruitment work?

Binance's report lays out the sequence. A person posing as a Project Director contacted the engineer — identified only as "Software Engineer B" — through a legitimate job-hunting platform. The engineer's profile referenced his experience at Binance.

From there, the scheme escalated. "The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company," Binance said in its report.

The "assignment" delivered during that process carried the malware. That's the takeaway: a credible-looking hiring funnel doubled as the delivery mechanism.

What was the second exploit?

The LinkedIn lure was only half the operation. The scheme ran for months and included a separate ad campaign that tricked another Binance engineer into downloading a malicious version of Homebrew, a popular software package.

The engineer didn't get the software through the company's regular channels. He clicked an internet ad promoting a tampered copy.

Binance says it detected the fake download and removed it from the employee's machine — but not before the hackers learned critical information about the engineer's role and the people who managed the company's wallets.

That combination did the damage. With the recruitment exploit and the intelligence from the poisoned Homebrew install in hand, the North Korean operators took over a series of Binance wallets and drained them during an attack that ran for several hours on Thursday.

What is Binance saying about its own rules?

Employees in non-public-facing roles are banned from maintaining LinkedIn profiles, a Binance spokesperson said. The spokesperson declined to say whether the engineer had violated that policy, or whether either engineer would be terminated.

The company did disclose its track record: it had flagged earlier hacker attempts against its staff on LinkedIn, and in 2026 it detected and blocked 57 North Korea-related hacking attempts. Fake-recruiter operations by North Korean hackers have become a widespread problem across the corporate sector well beyond crypto.

How much money came back?

Binance says it recovered around $2.5 billion of the roughly $6.3 billion stolen, after Tether and Circle froze stolen stablecoins. It shut down withdrawals for roughly 48 hours following the attack, then re-enabled them on Saturday.

The company has repeatedly said all customer funds are safe. It has replenished 98% of the stolen coins from reserve funds and other sources and is acquiring the remaining 2%, which consists of lesser-used currencies.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in a statement.

What's the so-what?

Two of the most damaging intrusions in corporate history — measured in dollars lost — came through an employment conversation and a routine software install, not a exotic zero-day. Every company that recruits engineers on public platforms now has a fresh, quantified reason to rehearse for exactly this play.