Skip to main content
BitCurrent

Crypto markets, protocols and policy

Binance says fake job interview preceded $6.3bn hack

Binance says attackers used a fake hiring process to compromise an engineer before a $6.3 billion theft, while the intrusion route remains under investigation.

BitCurrent Newsroom2 min read

Binance says fake job interview preceded $6.3bn hack

Binance says a fake job interview was part of the months-long effort behind its $6.3 billion security breach. The exchange disclosed the hiring tactic on Tuesday, adding a new detail to an attack that prompted it to suspend withdrawals.

  • About $6.3 billion in token assets were lost, Binance said.
  • About $3 billion had been frozen on-chain by October 30, according to Binance.
  • Binance said it had detected and prevented 57 suspected North Korea-linked cyber incidents in 2026.

How did the fake interview reach a Binance engineer?

Binance told Axios that an engineer was contacted in September through a job-hunting platform by someone posing as a project director at a fictitious company.

After a first interview by video, the supposed recruiter asked the engineer to download a code repository for a second-round assignment. Binance said the repository was infected.

The exchange also described a separate incident in June involving a tampered Homebrew installation used to install an AI coding tool. Binance said its security team detected that installation, replaced the device and rotated credentials.

What did the breach affect?

Binance’s October 30 security update said hot wallets were compromised around 20:05 UTC on October 29, leading to unauthorized withdrawals.

The exchange said it would cover the stolen funds through its Secure Asset Fund for Users and corporate treasury. It also said deposits and other unaffected platform services remained operational while withdrawals were temporarily suspended for security checks.

What is still unknown about the attack?

Binance said the initial investigation pointed to a compromised laptop, but later work found additional breach points. The exchange said it had no evidence that wallet private keys were leaked.

The full attack sequence and contributing factors remain under investigation. Binance has not yet published a complete technical account, and the hiring approach is one reported entry point within a broader incident.

Source material