Binance’s $6.3 Billion Heist Began With a Fake Job Interview
Binance’s $6.3 Billion Heist Began With a Fake Job Interview
The operation, according to Binance’s account, began well before the money moved. In June, hackers allegedly started probing the exchange’s wallet team; by September, someone posing as a project director contacted a software engineer through a job platform.
The bait was a convincing fake recruitment process: two interview rounds, including a video call with an apparent HR representative, followed by an “assignment” to download on the engineer’s work computer. Binance said the file carried malicious code that its security tools did not catch. The company later described the method as more advanced and deceptive than tactics it had previously faced.
On Oct. 20, nine days before the theft, the attackers used the compromised machine and an internal Binance AI tool to seize control of two wallet-team engineers’ computers. One engineer had authority to deploy software. That access, Binance said, opened the route to a transaction-signing service; over nearly four hours, attackers drained hot wallets used for rapid customer withdrawals.
Binance’s verdict was blunt: “This should not have happened.” The scale made the failure historic, eclipsing the roughly $1.5 billion stolen from Bybit in February 2025.
Stopping withdrawals did not immediately halt the outflow, Binance said, because the attackers had gained partial control of an Ethereum account in a way recorded on the blockchain rather than solely inside Binance’s systems. The exchange said its engineers had to devise a workaround, while the attackers allegedly routed funds through about 12,000 wallets to frustrate freezes.
The FBI on Saturday blamed TraderTraitor, a North Korean hacking unit; North Korea denied the allegation. Binance said it has frozen or intercepted about $2.85 billion, replenished 98% of affected tokens and will cover customer losses, while rebuilding systems and commissioning an external review.
Write a comment