Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’
Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed. The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to…
Binance revealed a massive $6.43 billion theft that resulted from a sophisticated multi-stage cyberattack targeting its internal infrastructure. The breach occurred through a series of coordinated actions, exploiting both technical vulnerabilities and social engineering tactics.
In June 2026, an engineer known as "Engineer A" inadvertently downloaded a trojanized Homebrew installer, which introduced a dangerous program into the company's wallet systems. While Binance promptly changed access keys and isolated the affected team, the breach exposed critical information to the attackers.
A month later, in September 2026, the attackers shifted their focus to "Engineer B." Through a deceptive recruitment process on a job search platform, Engineer B was lured into a series of deceptive interviews with individuals posing as HR and the company's CEO. The ultimate objective was to convince Engineer B to download a malicious code sample, which successfully compromised his computer.
On October 20, 2026, the perpetrators utilized Engineer B's compromised device, along with the access obtained from Engineer A, to infiltrate the company's internal AI tool. This enabled them to gain control over Engineer C, another team member. Between October 29 and 30, they leveraged stolen credentials from Engineer A to execute a malicious program, exploiting access to an internal transaction authorization service.
Through these actions, the attackers were able to execute unauthorized transfers and siphon off $6.43 billion in funds. In response, Binance took immediate action to contain the breach. By November 3, they had rebuilt the affected wallet system, updated their AI and access control systems, and replaced the compromised devices. The company also revoked old digital keys, conducted comprehensive security audits, and enhanced their ability to detect unusual behavior.
Additionally, Binance is collaborating with law enforcement and security experts to track and freeze any stolen assets.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Binance reveals hackers used fake job interviews, malicious code in $6.3bn heist dawn.com
- Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion Heist wired.com
- Binance hackers used fake job interview in US$6.3 billion attack straitstimes.com
- How fake job interviews helped hackers steal $6.34 billion from Binance gulfnews.com
- How $6,43 billion was stolen from Binance through fake interviews dev.to
- Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’ theguardian.com
- Binance says malicious code, fake job interview led to $6.3B hack thehill.com
- Binance Hackers Used Fake Job Interviews in $6.3 Billion Heist insurancejournal.com
