Binance Hack: A Fake Job Interview Opened the Door to the $6.34B Theft, Binance Says

In September 2026 a software engineer at Binance, the world's biggest crypto exchange, was contacted on a job-hunting website by someone claiming to be a project director. The engineer's profile mentioned his experience at Binance. A first interview followed, live on video, with a supposed HR representative, who shared a social media account full of personal photos and videos to win his trust.

The second interview took place in a chat app, with someone claiming to run a company that did not exist. Near the end, the engineer was told to download an assignment onto his work computer. It contained hidden malicious code, which ran as he set it up.

That is Binance's own account, published on 3 November in a report titled "29 October Binance Security Incident: Initial Findings and Response Update". It is the first time the exchange has explained how attackers got from an engineer's desk to about $6.34 billion in crypto, the biggest crypto theft on record. "This should not have happened," it says. The report calls itself initial. No independent firm has checked it, and Binance says some technical details will stay confidential, so there is still no full post-mortem. Everything below about the attack is Binance's version.

The trail, as Binance tells it

The interview was not the first contact. In June, an engineer on the wallet team, Engineer A in the report, searched online for a popular AI coding tool and downloaded a tampered copy of Homebrew, a common installer for developers' software. Binance's security team noticed, replaced his computer and changed the related credentials. It was too late for one thing: the report says his role and his colleagues on the wallet team were "exposed to the hacker". A burglar had been chased from the window, but had already read the staff list.

The September interview then gave the attackers a way in. Its target is Engineer B in the report, which names none of the three. Binance calls the malware "0-day", meaning security software had never seen it, and says its protection tools missed it. The program also covered its tracks. Binance does not say when it was found.

On 20 October the attacker used Engineer B's computer and "an internal AI tool" to take control of Engineer A and a third wallet engineer, Engineer C, in the report's words. Binance has not explained how the AI tool made that possible. On Engineer A's computer sat a token, a kind of digital staff pass, that allowed the deployment of containers, the small sealed programs that run on a company's systems.

On 29 October, between 17:15 and 19:56 (the report gives no time zone), the attacker logged onto Engineer C's computer, used Engineer A's stolen credentials, started a container and ran a malicious script. That reached the wallet signing service, the internal office that approves payments from Binance's hot wallets, the internet-connected accounts that work like a cash drawer.

This fits what Binance said on day one, that it had no evidence a private key had leaked. The thief did not need the key to the drawer. The thief got the cashier's approval.

Almost four hours

The money began moving at 20:05 UTC. By 20:09, five hot wallets had sent 233.46 million XRP to the attacker. About 970,500 SOL and 44.2 million OP followed from wallets on the Solana and Optimism networks. In the report's order of events, only then did an internal alert about large transfers reach Binance. Next, 18,270 bitcoin left. On day one outside analysts could not say whether those coins were part of the theft; Binance's report now counts them in it.

On Ethereum the attacker did something harder to undo. Using a feature called EIP-7702, and 50 signed transactions, the attacker gave a program under their control partial rights over a Binance hot wallet. It worked like a standing order lodged outside the bank: closing the branch did not cancel it. Suspending withdrawals "could not stop all unauthorized asset movements", the report admits.

Cancelling it took time. The wallet used Multi-Party Computation, which splits a key into shares so that no one master key exists, much like a safe that needs several people present. With no single key to hand, Binance's team had to build a special procedure. The last unauthorised transfer, 2,961.9 ether already in the queue, went through at 23:56 UTC, almost four hours after the first. The permission was cleared at 00:10 UTC on 30 October.

Binance now says about $2.85 billion has been "frozen or intercepted", subject to reconciliation, down from the "around $3 billion" it gave earlier. The tracing firm Chainalysis said about $2.8 billion on 3 November. That leaves about $3.5 billion unfrozen by Binance's count. Chainalysis puts the theft itself at about $6.4 billion.

The numbers that do not line up

Binance says it will absorb the loss and has set aside more than 100% of what it needs. How much it has actually replaced is harder to follow, because its own figures disagree.

On 31 October it said 90%. On 1 November it said about 95%, and it repeated that on 2 November. The 3 November report then says that "as of 31 October 2026", 98% of "impacted token assets" had been replenished. Yet on 4 November, Recovery Update #7 announced about 98% of the "impacted amount" as new progress. Binance has not said how 98% on 31 October fits with 95% two days later.

The report also calls the 98% verifiable on its Proof of Reserves page. Proof of Reserves is a public count of whether an exchange holds what it owes, using a mathematical receipt each customer can check. The only finished proof at that point, completed on 2 November, covered 10 tokens: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. Binance said the missing share sat in other tokens. A new snapshot taken on 4 November covers 44 tokens, but its proof needs about 50 to 60 hours to generate, so customers could not yet check it on Thursday 5 November.

Who did it, and who says so

The FBI attributed the theft to North Korea on 31 October, using the name TraderTraitor. Chainalysis attributes it to the same group, and says stolen Binance funds mixed on the blockchain with funds from September's theft at the exchange Bitget. Binance's report makes no finding of its own: it says only that FBI information "indicates" North Korea is responsible.

North Korea denies it. In a statement carried by the state news agency KCNA on 3 November, Kim Yo Jong, sister of leader Kim Jong Un, called the claim "absurd rhetoric and nothing new" and a "grave political provocation". President Donald Trump, speaking after the FBI's notice, told reporters: "We don't know if it's North Korea," according to AFP. Nobody has been charged.

The sums explain the interest. Reuters noted that the Bank of Korea, South Korea's central bank, put North Korea's whole economy at $35.09 billion in 2025, so the theft could equal about a sixth of it. Alec Zebrick of Chainalysis told Reuters the pattern could be called "big game hunting".

A trick older than the theft

Binance calls the attack "highly sophisticated", and the malware may have been. The bait was not. Palo Alto Networks' Unit 42 named the fake coding test Contagious Interview in 2023. The $625 million theft from the Ronin network in 2022 reportedly began with a fake job offer, and a fake recruiter got into AFX Trade in July 2026.

Binance knew this better than most. Its report says it detected and prevented 57 suspected North Korea-linked cases in 2026, including fraudulent job interviews and malware disguised as developer tools. On 27 October it announced it had blocked attacks tied to Contagious Interview, with no damage to its systems. It has not linked those attempts to this theft. By its own timeline, though, the attacker had been working from Engineer B's computer for at least a week. Two days later the drawer was empty.