Binance Hack: How a Fake Job Interview Helped Start a $6.3 Billion Crypto Theft, What Is Confirmed and What Businesses Should Change

Binance says about $6.34 billion in digital assets was stolen on October 29, 2026, and that a key step in the break-in was a fake job interview aimed at one of its engineers. This matters well beyond crypto, because the same trick works against any company whose staff can reach code, servers or money from a work laptop.

A note on sourcing. Binance published its account on November 3 and the FBI published an alert on October 31, but neither page would load in our research tools. The Binance details below come from reporters quoting that report, and the FBI wording comes from BleepingComputer's quotation of the alert. The FBI and CISA defensive guidance comes from the agencies' own pages, which we opened directly.

What happened in the Binance hack

This is Binance's own account, as reported by BleepingComputer, The Register and GovInfoSecurity.

Two details stand out. The fake HR interviewer shared a social media account full of personal photos and videos to build trust, which Binance called "more advanced and deceptive than previously seen social engineering approaches." And Binance said of the malware: "The 0-day malware was not detected by the endpoint security protection tools at the time."

Was North Korea behind the Binance hack? Confirmed versus claimed

The FBI says North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" on or about October 29, and calls the activity TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38. That is a government attribution, and North Korea has rejected it.

Binance says about $6.34 billion was stolen, about $2.85 billion had been frozen or intercepted as of November 3, and 98 percent of impacted token assets had been replenished as of October 31. These are the company's own figures, and we found no independent audit of them.

Binance has not tied the employee compromise to a named campaign. BleepingComputer points out that the tactics resemble two documented North Korean campaigns, Contagious Interview and Operation Dream Job. That is an observation, not a finding.

Still not known:

• How the June engineer came across the tampered Homebrew installer. Accounts differ.
• What the internal AI tool normally does and exactly how it was misused. The coverage we read does not say.
• How much of the frozen money will ultimately be returned.
• Whether the independent review Binance commissioned will change this account.

Why a fake job interview attack matters to your business

You do not need to hold crypto to have this problem. Three parts of the story apply to any company network.

The way in was a private job search. No email filter sits between a recruiter on a job site and an employee who is quietly looking for a new role. The employee has every reason not to mention it to anyone at work.

Security software was not enough. Binance's own endpoint tools missed this malware, so a clean antivirus report does not prove a laptop is safe.

One laptop led to the next. The attackers went from a software engineer's machine to the wallet team and found a deployment token stored on a computer. Your network is only as safe as its weakest device, and a stolen token often skips the login step entirely, which is why MFA alone does not stop stolen credentials.

None of this is a new warning. CISA's April 2022 advisory on TraderTraitor described lures that "offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications." The FBI's September 2024 alert, I-090324-PSA, lists "Requests to execute code or download applications on company-owned devices" as a warning sign, along with requests to complete a pre-employment test or debugging exercise.

What to do this week

• Ban interview code on company devices. Put it in writing: no test assignments, take-home projects or recruiter downloads on work machines. The FBI suggests a virtual machine that is not on company equipment for anyone who must run one.
• Make recruiter contact reportable without penalty. Tell developers, admins and finance staff that an unexpected job offer is worth a quick note to IT, and that nobody gets in trouble for job hunting.
• Verify people through a second channel. The FBI recommends confirming identity using a separate, unconnected platform. Apply that to candidates and vendors you hire as well.
• Find tokens stored on laptops. List deployment tokens, cloud keys and SSH keys saved on staff machines and in build systems. Replace long-lived ones with short-lived credentials, and write down who can deploy to production.
• Control where developer tools come from. CISA advises verifying third-party downloads and using application allowlisting. Install tools such as Homebrew from the official source or an approved list, and agree who owns keeping that software current.
• Limit what internal AI tools can reach, and require a second approval for money. Check which computers and secrets your AI assistants can touch, and log their use. The FBI recommends approvals from separate, unconnected networks before financial assets move.

Binance hack questions people are asking

How much was stolen in the Binance hack?

Binance puts it at about $6.34 billion. The FBI says more than $6 billion.

Did a fake job interview really cause the Binance hack?

It was one step, not the whole story. Binance's account starts with a tampered Homebrew download in June, then the fake interview in September, then a stolen deployment token in October.

Was North Korea behind the Binance hack?

The FBI says yes and names TraderTraitor. North Korea rejects that, and Binance has not tied the employee compromise to a specific campaign.

Did Binance customers lose money?

Binance said it replaced most of the stolen crypto with its own funds and that 98 percent of impacted token assets were replenished as of October 31. We found no independent check of that figure.

How can a company spot a fake recruiter?

The FBI's warning signs include unexpected offers from well-known firms, pressure to move to another messaging app, and any request to run code or a script as a test.

The bigger lesson

The most expensive step in this story looked like an ordinary career move. Attackers will study who works on what, then approach that person where company security cannot see. The useful question for any business is what one person's laptop can reach, and how far an attacker could travel from it.

For help reviewing developer access, stored tokens and device rules, see our security hardening work or get a quote.

Get security alerts by email, with the free checklist, at security alerts.

Sources: FBI alert I-090324-PSA; CISA advisory AA22-108A; BleepingComputer on Binance's report; BleepingComputer on the FBI alert; The Register; GovInfoSecurity; NPR via WUNC; HRD.