Binance says malicious code, fake job interview led to $6.3B hack
Binance said Tuesday that a $6.3 billion hack of the world's largest cryptocurrency exchange was the result of a "multi-stage campaign," including a malicious software download and a fake job interview. Hackers, whom both the FBI and outside analysts have linked to North Korea, moved billions of dollars' worth of crypto out of Binance wallets...
Binance revealed a massive $6.43 billion theft that resulted from a sophisticated multi-stage cyberattack targeting its internal infrastructure. The breach occurred through a series of coordinated actions, exploiting both technical vulnerabilities and social engineering tactics.
In June 2026, an engineer known as "Engineer A" inadvertently downloaded a trojanized Homebrew installer, which introduced a dangerous program into the company's wallet systems. While Binance promptly changed access keys and isolated the affected team, the breach exposed critical information to the attackers.
A month later, in September 2026, the attackers shifted their focus to "Engineer B." Through a deceptive recruitment process on a job search platform, Engineer B was lured into a series of deceptive interviews with individuals posing as HR and the company's CEO. The ultimate objective was to convince Engineer B to download a malicious code sample, which successfully compromised his computer.
On October 20, 2026, the perpetrators utilized Engineer B's compromised device, along with the access obtained from Engineer A, to infiltrate the company's internal AI tool. This enabled them to gain control over Engineer C, another team member. Between October 29 and 30, they leveraged stolen credentials from Engineer A to execute a malicious program, exploiting access to an internal transaction authorization service.
Through these actions, the attackers were able to execute unauthorized transfers and siphon off $6.43 billion in funds. In response, Binance took immediate action to contain the breach. By November 3, they had rebuilt the affected wallet system, updated their AI and access control systems, and replaced the compromised devices. The company also revoked old digital keys, conducted comprehensive security audits, and enhanced their ability to detect unusual behavior.
Additionally, Binance is collaborating with law enforcement and security experts to track and freeze any stolen assets.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Binance reveals hackers used fake job interviews, malicious code in $6.3bn heist dawn.com
- Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist wired.com
- Binance hackers used fake job interview in US$6.3 billion attack straitstimes.com
- How fake job interviews helped hackers steal $6.34 billion from Binance gulfnews.com
- How $6,43 billion was stolen from Binance through fake interviews dev.to
- Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’ theguardian.com
- Binance Hackers Used Fake Job Interviews in $6.3 Billion Heist insurancejournal.com
- Binance says hackers used fake job interview to compromise computer before $6.3 billion attack channelnewsasia.com
