Story
Nov 6, 2026
Binance’s $6.3 Billion Hack Began With a Convincing Fake Interview
Binance’s account portrays the breach as a patient, highly tailored campaign that exploited both human trust and internal technology; U.S. investigators see North Korean involvement, an attribution North Korea rejects.
The attack, Binance says, did not begin with a dramatic breach of its wallets. It began months earlier with reconnaissance — and a lure aimed at an employee.
In June, attackers allegedly started probing the exchange’s wallet team, including through a tampered version of a popular software tool. Then, in September, someone posing as a project director contacted a Binance software engineer through a job-hunting platform. Two interviews followed, including a video call with a purported HR representative. The final “assignment” was a file to download on the engineer’s work computer; it carried malicious code that Binance’s security tools did not detect.1
The deception was built to look ordinary. Binance said the fake interviewer used a social-media account packed with personal photos and videos to bolster credibility — a level of polish the company described as more sophisticated and deceptive than tactics it had previously encountered.2
On Oct. 20, roughly a week before the theft, the attackers used the compromised machine and an internal Binance AI tool to take control of two wallet-team engineers’ computers. One engineer had authority to deploy software. Nine days later, that access opened a transaction-signing service, allowing the attackers to drain hot wallets — funds held for rapid withdrawals — over nearly four hours. “This should not have happened,” Binance said.1
Stopping withdrawals alone was not enough, Binance said. The attackers had gained partial control of an Ethereum account in a way recorded on the blockchain rather than solely inside Binance’s systems, forcing engineers to devise a workaround while the theft continued.2
The FBI said Saturday that North Korea’s TraderTraitor hacking unit carried out the operation; North Korea has denied the allegation. Binance says it has blocked 57 other suspected North Korean hacking attempts this year. It says about $2.85 billion has been frozen or intercepted and that it has replenished 98% of affected tokens, while rebuilding systems and bringing in outside security reviewers.1