Binance Hackers Used Fake Job Interviews and Malware to Steal $6.3 Billion
Hackers compromised employee computers and stole internal credentials to infiltrate Binance’s wallet infrastructure, using a carefully planned cyberattack that began months before the exchange lost $6.3 billion in digital assets.
The attack involved fake job interviews, malicious software disguised as coding assignments and the abuse of internal security systems, according to a postmortem published by Binance on Tuesday.
The investigation found that the campaign started in June, when an engineer downloaded a modified software package while installing an AI coding tool. Binance detected the malware and replaced the affected computer, but the attackers had already collected information about the exchange’s wallet security team.
The hackers launched another attack in September, this time posing as recruiters. They contacted a software engineer and convinced the employee to download a malicious file presented as part of a coding assignment. The software infected the engineer’s work computer while avoiding Binance’s security defenses.
On Oct. 20, the attackers used the compromised device and an internal AI tool to access the systems of two additional engineers. This gave them access to deployment credentials, which they later used to introduce malicious software into Binance’s wallet infrastructure on Oct. 29.
Once inside, the attackers reached the exchange’s internal wallet-signing service, which approves cryptocurrency transactions. This access allowed them to transfer funds without following Binance’s standard withdrawal procedures.
Binance described the incident as a months-long operation rather than a single security failure, highlighting how attackers combined social engineering, stolen credentials and technical weaknesses to bypass its defenses.
The hackers also took advantage of Ethereum's EIP-7702 mechanism, which allows cryptocurrency wallets to delegate transaction permissions to smart contracts. This enabled unauthorized transfers to continue even after Binance suspended withdrawals. The exchange's multiparty computation (MPC) wallet system, which distributes control over transaction signing, also made it more difficult to revoke the permissions.
The breach affected approximately $6.3 billion in digital assets. Binance said it had frozen or intercepted $2.85 billion of the stolen funds based on its latest accounting. The exchange also committed to covering the losses itself rather than passing them on to customers. By Oct. 31, it had replenished 98% of the affected token assets.
The Federal Bureau of Investigation (FBI) has attributed the attack to North Korean hackers. However, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, rejected the accusation on Tuesday, describing it as politically motivated and intended to harm the country's international reputation.
Binance also revealed that its security teams had identified and stopped 57 suspected North Korea-linked cyber threats during 2026. These included fake recruitment campaigns, infected software packages and social engineering attempts designed to steal employee credentials or install malware.
The incident has raised fresh concerns about the security of cryptocurrency exchanges, particularly the risks posed by attacks targeting employees rather than directly exploiting blockchain networks. Binance's investigation shows how a single compromised computer can eventually provide attackers with access to critical financial infrastructure.