Binance $6.3 Billion Hack Began With a Fake Job Interview, Exchange Reveals

Binance has revealed how the largest cryptocurrency theft in history began: not with a breach of its trading engine, but with a fake job interview. In a briefing on Tuesday, November 3, 2026, the exchange said the Binance $6.3 billion hack started when a software engineer was lured through a legitimate job platform, put through a bogus interview process, and persuaded to download a coding assignment carrying malware that evaded endpoint security.

The theft took place on October 29, when about $6.3 billion left Binance's hot wallets. The exchange said about $2.85 billion has since been frozen, and about 98 percent of affected tokens have been replenished with company funds, so users will not be affected. Co-chief executive Richard Teng said the FBI has attributed the attack to North Korea, an attribution Pyongyang denies.

Key Points

• Binance says the $6.3 billion October 29 theft, the largest crypto heist on record, began with a fake job interview in September 2026.
• A coding assignment downloaded by an engineer carried zero-day malware that evaded endpoint security, Binance said.
• In June 2026, another wallet-team engineer installed a tampered Homebrew package while searching for an AI tool.
• On October 20, attackers used the compromised machine and an internal AI tool to reach two wallet engineers' computers.
• Funds left from 20:05 UTC on October 29, with containment only by 00:10 UTC on October 30.

What Happened

Binance said the campaign began in September 2026, when a software engineer was contacted through a legitimate job platform by someone posing as a project director. The engineer went through a fake video interview with a human resources representative, then a supposed interview with the chief executive of a fictitious company. Finally, the engineer was told to download a coding assignment onto a work computer. That file, Binance said, contained zero-day malware, software exploiting a previously unknown vulnerability, which slipped past endpoint security.

A second foothold dated to June 2026, when another wallet-team engineer installed a tampered Homebrew package while looking for an AI tool. Homebrew is a widely used package manager for macOS, and a tampered package can quietly install malicious code. Binance said the affected device was replaced, but the wallet team remained exposed, showing how hard it can be to be sure an intrusion is fully removed.

On October 20, attackers used the compromised machine and an internal AI tool to reach two wallet engineers' computers. On October 29, stolen credentials deployed a container running a malicious script. Funds left from 20:05 UTC, contained only at 00:10 UTC on October 30.

Background and Context

The October 29 theft immediately became the largest cryptocurrency heist ever reported, drawing in law enforcement, blockchain analytics firms, and rival exchanges that moved to freeze suspect funds. Binance, the world's largest crypto exchange by trading volume, first suspended withdrawals for all users, then reopened them in phases. It has since said it covered the overwhelming majority of losses from its own funds.

The FBI pointed to TraderTraitor, associated with the Lazarus Group; North Korea denies it. Fake-interview recruitment has been documented against tech workers for years.

Binance $6.3 Billion Hack: How the Attack Unfolded

The technical heart of the theft involved two features of modern crypto infrastructure. First, Binance said, attackers exploited Ethereum's EIP-7702 feature to gain execution rights over a hot wallet. EIP-7702 lets an externally owned account temporarily delegate execution to smart-contract code, a flexibility meant to improve the experience for ordinary wallet holders. In the wrong hands, Binance's account suggests, it gave attackers a way to act with the wallet's authority.

Second, because Binance's hot wallets use multiparty computation, no single key could revoke that access on its own. That design splits signing authority so no one person or device holds a complete private key, preventing a single compromise from being fatal. In this case, Binance said, it also made the attack harder to shut down quickly. Meanwhile, Binance's disclosure that it blocked 57 suspected North Korea-linked attempts this year suggests the October attack was the one attempt, among many, that succeeded.

Reactions and Statements

Binance has framed its disclosure as part of an effort to be transparent about what went wrong, emphasising that users will not bear the cost because about 98 percent of affected tokens have been replenished. The exchange also said it will bring in independent cybersecurity experts to review the incident, a recognition that internal reviews alone may not restore confidence after a breach of this size.

The FBI's attribution remains contested. Pyongyang has denied involvement outright, rejecting the TraderTraitor attribution. That dispute is unlikely to be settled by public statements alone, mirroring earlier disagreements over state-linked cyberattacks, where technical evidence is often detailed but attribution rests on intelligence assessment rather than courtroom proof. In the industry, the case will also fuel debate over how much customer money should sit in internet-connected hot wallets versus offline cold storage.

Why It Matters

The hack matters for three reasons. First, its size: at $6.3 billion, it tests whether even the biggest, best-resourced exchange can protect customer funds against a determined state-linked adversary. Second, its method: the fake-interview vector shows that social engineering, not exotic cryptography, remains the most reliable way into a well-defended organisation. Third, its aftermath: the recovery of $2.85 billion, and the replenishment of 98 percent of affected tokens, will shape how regulators, customers, and investors judge whether the crypto industry can absorb a catastrophe without users losing money.

What Happens Next

Binance's independent cybersecurity review is the most immediate next step. If its findings are published, they could reshape industry practice around hot-wallet security, multiparty computation, and employee-device controls. Law enforcement efforts to freeze and recover the remaining funds will continue, and the $2.85 billion already frozen may grow as analysts trace further movements.

Regulators may ask whether exchanges should hold larger reserves or submit to mandatory independent audits. For Binance, transparency about the review will determine whether customers treat this as a lesson learned or a warning sign.

Frequently Asked Questions

How did the Binance hack begin?

Binance says it began with a fake job interview in September 2026. An engineer was contacted through a legitimate job platform, went through a bogus video interview process, and downloaded a coding assignment containing zero-day malware.

How much was stolen in the Binance hack?

About $6.3 billion was stolen on October 29, 2026. About $2.85 billion has been frozen, and 98 percent of affected tokens have been replenished.

Who does the FBI blame for the Binance hack?

The FBI has attributed the attack to North Korea, pointing to a group it calls TraderTraitor, associated with the Lazarus Group. North Korea denies the attribution.

What is EIP-7702 and why did it matter?

EIP-7702 lets an Ethereum account temporarily delegate execution to smart-contract code. Attackers exploited it for hot-wallet execution rights, and no single key could revoke access quickly.

Will Binance users lose money because of the hack?

Binance says no. The exchange says about 98 percent of affected tokens have been replenished with company funds, so users will not be affected financially.

Read more: original hack report, FBI attribution, North Korea denial.

Image: original US News Pulse illustration, not a Binance or source-site photograph.