Hackers Use Fake Job Interview to Steal $6.34 Billion from Binance

Binance reports that North Korean state‑sponsored hackers employed a bogus job interview to compromise a Binance software engineer and ultimately siphon $6.34 billion. No official confirmation has been published.

How the breach unfolded

The intrusion began in September 2026 when an impersonator, posing as a Project Director on a legitimate job‑hunting platform, reached out to a Binance engineer. The recruiter sent a coding assignment hosted in an online repository. The assignment contained a malicious version of the macOS Homebrew pyenv executable, which replaced the legitimate tool on the engineer’s machine.

By 20 October 2026 the compromised workstation, together with an internal AI tool, was leveraged to infiltrate two additional members of Binance’s wallet‑infrastructure team. The attackers harvested credentials and a container deployment token, giving them deeper access to the exchange’s critical signing environment.

Execution of the theft

On 29 October 2026 the stolen credentials enabled the hackers to deploy a script that interacted with Binance’s wallet signing service. The script initiated a series of transfers that moved billions of dollars across multiple blockchain networks. Even after Binance temporarily halted withdrawals, the attackers exploited Ethereum’s EIP‑7702 authorization mechanism to continue draining funds.

Response and current status

Binance announced that, as of 3 November 2026, roughly $2.85 billion of the stolen assets had been frozen or intercepted. By 31 October 2026, 98 % of the impacted token assets had been replenished to customers. The exchange has rebuilt the affected systems, replaced compromised devices, revoked the stolen credentials, and engaged independent security firms to investigate the incident.

Impact on users and advice

While the breach primarily targeted Binance’s internal wallet‑infrastructure team, the fallout directly affects the exchange’s customers, many of whom saw their balances temporarily frozen or altered. Users should review their account activity for any unauthorized transactions, enable hardware‑based two‑factor authentication, and consider moving assets to cold storage if they are not actively trading. Monitoring official Binance communications for updates on asset recovery and security enhancements is also recommended.

Why it matters

The attack demonstrates how social‑engineering tactics, such as fake recruitment offers, can bypass traditional technical defenses and give threat actors footholds in high‑value financial systems. It underscores the need for organizations handling crypto assets to vet external communications rigorously, enforce strict code‑review processes for third‑party tools, and maintain robust monitoring of privileged credential usage.

Sources

• https://www.binance.com/en/blog/community/3229153443759566763

This brief was prepared with AI assistance from the sources above and reviewed by our editors.