Binance Hack: A Fake Job Interview and a Tampered Download Led to the $6.34 Billion Theft, What Is Confirmed and What Businesses Should Check

The crypto exchange Binance says attackers stole about $6.34 billion in digital assets on October 29, 2026, after getting malware onto employees' work computers through a fake job interview and a tampered software download. If your staff install developer tools from search results or take "coding tests" on work laptops, your company has the same opening.

The FBI attributed the theft to North Korea on October 31, and Binance explained how it happened in a report updated November 3. Below: what is confirmed, what is not, and what to check this week.

How the Binance hack happened

Binance's report describes an attack that was in motion from at least June and went through three employees, called Engineers A, B and C.

Binance says the interview malware replaced part of pyenv, a common Python developer tool, with a malicious copy that took commands from an attacker's server. The attacker also abused EIP-7702, an Ethereum feature that lets an account hand some rights to a smart contract. In 50 transactions the attacker set up malicious delegations on a hot wallet. Those delegations were recorded on the blockchain, so suspending withdrawals did not cancel them. Binance cleared the delegation at 00:10 UTC on October 30.

What is confirmed and what is not

From Binance's report:

• About $6.34 billion in digital assets were affected.
• About $2.85 billion has been frozen or intercepted, subject to reconciliation and price changes.
• As of October 31, 98% of affected token assets had been replenished, and Binance says it will cover the financial impact for users.
• Binance rebuilt the wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced devices, retired affected credentials and tokens, and scanned all employee devices.

From the FBI: An FBI alert dated October 31, 2026 says North Korea was responsible for the theft of "more than $6 billion USD in virtual assets" from Binance on or about October 29, and calls the activity TraderTraitor. Together with the Secret Service and IRS Criminal Investigation, the FBI asked exchanges and other services to block transactions tied to the laundering addresses it listed.

Not known: Binance has not named the job platform, the chat app, the AI coding tool or the internal AI tool, and says some technical details will stay confidential. It has not explained exactly how the AI tool was used to reach colleagues. An independent review is underway, so details may change.

Why a fake job interview works on a company network

The fake interview targeted a person, not Binance's systems. The "recruiter" built trust over a video call and a social media account, and the last step looked like a normal hiring task: download a repository and run setup. Developers do that every day. The mistake was doing it on a work computer that could reach company systems.

The June download teaches the same lesson in a different way. Our post on ArmorSteal malware covered fake download sites for Windows tools. Binance's report shows the same trick working against Homebrew on a Mac.

After that, the attacker spread to other machines. One laptop, plus an internal AI tool, gave the attacker access to two more people, and one of them had a deployment token saved on the machine. That token opened the signing service. As our infostealer post showed, attackers use stolen credentials quickly.

A company does not need billions in crypto to be a target. If your staff can deploy code, approve payments or reach customer data, you have something worth stealing this way.

What to do this week

If your team runs its own servers or deployment pipeline, our self-hosting infrastructure page explains how access can be set up so no single device can deploy on its own.

Binance hack questions people are asking

How much was stolen in the Binance hack?

Binance says about $6.34 billion in digital assets were affected on October 29, 2026. The FBI says more than $6 billion.

Who was behind the Binance hack?

The FBI attributes it to North Korea and calls the activity TraderTraitor.

Did Binance customers lose money?

Binance says it will cover the financial impact for users. It also says 98% of affected token assets had been replenished as of October 31.

How did a fake job interview lead to the hack?

An engineer ran a coding "assignment" from a fake employer on a work computer. Its setup script installed malware, which the attacker later used to reach colleagues with access to wallet systems.

How can I spot a fake job interview?

Watch for offers you did not ask for, a company you cannot verify, interviews moved to chat apps, and any request to download and run code. Never run test code on a work device.

The bigger lesson

This $6.34 billion theft did not start with a clever exploit. It started with employees doing ordinary things on work laptops: installing a tool from a search result and taking a coding test. Treat every work device as a key to the company, and make sure no single key opens everything.

Want help locking down developer access and deployments? See security hardening or get a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Binance: Initial Findings and Response Update; FBI: North Korea Responsible for $6 Billion+ Binance Attack.