Binance says fake job interview preceded $6.34 billion hack

Binance says hackers used a fake job interview to get into its systems before $6.34 billion in digital assets were affected last week, exposing a breach that began months earlier. The exchange described the attack in a Tuesday briefing, according to CoinDesk’s report on the briefing and Reuters’ account of Binance’s report.

How did a fake interview reach Binance’s systems?

Binance said an engineer was contacted in September by a fake recruiter on a job platform. The engineer joined video interviews and downloaded a coding assignment that contained malware, malicious software designed to get into a computer. Reuters reported that the supposed role included a video meeting with the fictitious company’s CEO.

The attack had an earlier foothold. Binance said an employee on its wallet development team downloaded a tampered software tool in June. The company detected the problem, replaced the device and changed credentials, but said the team’s exposure continued.

How did the attackers move the crypto?

Binance said the attackers used a compromised computer and an internal AI tool on Oct. 20 to reach two wallet developers’ systems. On Oct. 29, they used stolen credentials and a malicious script to move assets from the exchange’s wallets. A wallet stores crypto so it can be held or transferred.

According to Reuters, 233.46 million XRP left five Binance internet-connected wallets in four minutes. Other crypto followed. Binance said the first transfers began around 20:05 UTC and the final unauthorized transfer came nearly four hours later, even as it investigated and suspended withdrawals.

What does Binance say happened to the affected funds?

Binance reported that about $2.85 billion in assets had been frozen and that it would repay customers whose funds were stolen. The exchange said approximately $6.34 billion in digital assets were affected; that figure describes the scale of the incident, not the amount ultimately lost by customers.

The FBI attributed the attack to North Korea, Reuters reported, while North Korea rejected the claim. Binance said it had blocked 57 suspected North Korea-linked threats during 2026. It also said it would bring in independent cybersecurity experts to review the incident.

Sources and documents

• CoinDesk’s report on the briefing — coindesk.com
• Reuters’ account of Binance’s report — investing.com