Binance Reveals How Hackers Used Fake Recruitment to Steal $6.3bn

Cryptocurrency exchange Binance has revealed that hackers used a fake job interview, malicious software and an internal artificial intelligence tool to gain access to its systems before stealing approximately $6.34 billion in digital assets in what is being described as one of the largest cryptocurrency thefts on record.

In an initial incident report released on Tuesday, November 3, Binance said the attack was the result of a sophisticated, multi-stage operation that began months before the theft on October 29.

According to the exchange, the attackers first compromised an employee’s computer in June after the worker downloaded a tampered version of a software installation tool while attempting to install an artificial intelligence coding application.

Although Binance detected the suspicious activity, replaced the affected device and changed the employee’s credentials, the attackers had already gathered information about the worker’s role and other members of the company’s wallet infrastructure team.

The operation took another turn in September when a second software engineer, who was seeking a new job, was contacted through a legitimate employment platform by someone posing as a project director.

Binance said the engineer was invited to participate in two interviews. The first involved a person claiming to be a human resources representative, while the second featured someone posing as the chief executive of a fictitious company.

During the recruitment process, the supposed interviewer shared a social media account containing personal photographs and videos to establish credibility and gain the employee’s confidence.

The engineer was subsequently asked to complete a coding assignment by downloading a repository onto a work computer. Binance said the repository contained malicious code that began executing during the installation process, giving the attackers access to the employee’s computer.

The hackers then combined information obtained from the compromised devices with access to an internal AI tool to gain control of the systems of two other employees involved in wallet development.

By October 29, they had obtained the credentials and permissions needed to interfere with Binance’s wallet signing operations, which authorise cryptocurrency transactions.

The attackers initially transferred 233.46 million XRP from five internet-connected Binance wallets within four minutes before moving other digital assets, including Bitcoin, Solana, Ethereum and Optimism tokens, to addresses under their control.

Binance said the incident affected approximately $6.34 billion worth of digital assets. It managed to freeze or intercept about $2.85 billion in assets, although the unauthorised transfers continued for nearly four hours as the company worked to contain the breach and revoke the compromised permissions.

The company said it had replenished 98 per cent of the affected token assets as of October 31 and had set aside more than enough funds to cover the loss. It also assured customers that the financial impact would be borne by Binance rather than users.

The Federal Bureau of Investigation has attributed the attack to North Korea, according to Binance’s report. North Korea has denied involvement, while the attribution has renewed concerns about the growing sophistication of cybercrime operations linked to cryptocurrency theft.

The incident has also drawn attention to the use of fake recruitment exercises as a means of infiltrating technology companies. Cybersecurity agencies have previously warned that suspected North Korean hackers target software developers and IT professionals with fraudulent job offers, coding tests and malicious applications.

Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats during 2026, highlighting the scale of attempts to compromise its employees and systems.

Following the breach, the exchange said it had rebuilt affected systems, replaced compromised devices, withdrawn exposed credentials and strengthened controls around its wallet services. It is also increasing investment in artificial intelligence-based security monitoring and plans to establish a security research fund with industry and technology partners.

The company said an independent cybersecurity review would be conducted as investigations continue.

The attack has raised wider questions about the security of cryptocurrency exchanges, particularly the risks posed by employees whose devices and access permissions can provide a route into systems holding billions of dollars in digital assets.