Fake job interview helped hackers pull off Binance's $6.3 billion heist

Binance said hackers used fake job interviews, malicious code and AI techniques to steal $6.3 billion. The breach shows how social engineering can escalate into a coordinated attack on cryptocurrency systems.Binance strengthens security with AI tools and infrastructure rebuild. New,Nov 4, 2026 08:01 ISTThe hackers behind the $6.3 billion breach at cryptocurrency exchange Binance used fake job interviews, malicious software disguised as legitimate developer tools and artificial intelligence (AI) techniques to infiltrate the company's systems, according to a detailed account released by the exchange.Binance said the attackers carried out a sophisticated, multi-stage campaign that began by targeting one of its software engineers through a job-hunting platform. The hackers allegedly posed as a project director and later arranged an interview with the employee through a social messaging app, claiming to represent a fictitious company.The employee was then asked to download an assignment containing a malicious code repository. This triggered a series of unauthorised activities, Binance said in a report published on Tuesday, November 3.The disclosure offers a closer look at how the attackers gained access to the exchange's systems and eventually carried out one of the biggest cryptocurrency thefts on record. Binance attributed the attack to North Korea. The country has denied responsibility for the breach.HOW THE HACKERS USED FAKE JOB INTERVIEWSAccording to Binance, the attackers did not rely on a single compromised device or security lapse. Instead, they combined fake recruitment interviews, malicious software disguised as developer tools, compromised devices and AI techniques to gain access. "This was not a single mistake or a single breach. It was a campaign built over many months," Richard Teng, co-chief executive officer of Binance, said.The initial target was an engineer who was contacted through a job-hunting platform by someone posing as a project director. The employee was subsequently interviewed by a person claiming to be the chief executive of a fictitious company over a social chat application.During the interaction, the engineer was asked to download an assignment that contained malicious code. This gave the attackers a way into the employee's device, Binance said.The breach then widened. Nine days before the hack, attackers used the laptop of the employee targeted through the fake interview to infiltrate the computers of two other software engineers who worked on Binance's digital wallets.One of these two engineers had accidentally downloaded malicious software in June while attempting to install what Binance described as a popular AI coding tool. This exposed information about the employee's role and the work of colleagues involved in the exchange's wallet systems, according to the report.The hackers also used an internal AI tool to gain access to the computers of the two engineers. Binance did not specify what the tool was or how it was used to take control of the devices.NORTH KOREA LINK AND A HISTORY OF CRYPTO HEISTSBinance attributed the breach to North Korean hackers, a finding also made by the US Federal Bureau of Investigation (FBI). North Korea has denied the allegation.The tactics described by Binance are similar to methods previously associated with North Korean cyber operations. Cybersecurity firm Palo Alto Networks has called the fake job-interview technique "Contagious Interview".In 2022, North Korean hackers used a fake job offer to target an engineer working for crypto-powered game Axie Infinity, resulting in a $590 million theft.Three years later, hackers from the country broke into cryptocurrency exchange Bybit and stole $1.5 billion. That attack had been considered the largest digital asset heist in history before the Binance incident, according to cryptocurrency analytics firms.The latest breach comes amid growing cybersecurity concerns in the cryptocurrency industry. Binance said it identified and prevented 57 attempted attacks by hackers connected to North Korea in 2026.BILLIONS FROZEN, WITHDRAWALS PAUSEDThe Binance breach was first reported on October 29. In its initial response, the exchange said attackers may have compromised a software engineer's laptop, allowing them to withdraw cryptocurrency from the platform.The company later described the attack as complex and said it had uncovered additional points of breach.In the aftermath, stablecoin issuers Tether and Circle, along with other entities, froze or stopped hackers from moving almost $3 billion in funds. Cryptocurrency analytics firms also tracked the movement of the stolen assets.Binance paused withdrawals for almost two days following the incident. It began progressively allowing customers to withdraw funds early on Sunday. The exchange initially saw billions of dollars in outflows, but said the situation had stabilised by Tuesday, with hourly deposits beginning to exceed hourly withdrawals.The company also said it had almost replenished the cryptocurrency stolen in the hack using funds from its corporate treasury and two insurance funds. It is working with US law enforcement agencies, including the FBI, the US Secret Service and the Department of Justice.BINANCE STEPS UP SECURITY MEASURESBinance said it has introduced several measures following the breach. These include rebuilding the affected cryptocurrency infrastructure, redeveloping the internal AI tool, strengthening security scans and deploying an AI-powered detector.The incident has also highlighted the growing risks posed by social engineering and the use of AI in cyberattacks. While the hackers relied on a fake recruitment process to approach employees, the subsequent use of malicious software and compromised devices allowed the operation to move beyond the initial target.Despite the scale of the breach, the immediate market impact was relatively limited. Bitcoin fell more than 4% after the exploit, touching nearly $76,000, before recovering some of its losses to trade around $77,600 on Tuesday, according to Bloomberg.The Binance disclosure shows how a cyberattack involving billions of dollars in digital assets can begin with something as routine as a job interview, before escalating into a coordinated attempt to compromise an exchange's internal systems.- Ends