{
  "id": 18060728,
  "title": "Binance reveals hackers used fake job interviews, malicious code in $6 billion heist",
  "url": "https://urgent.news/2026/11/04/binance-reveals-hackers-used-fake-job-interviews-malicious-code-in-6",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-04T03:12:00.000Z",
  "source": {
    "name": "The Hindu - Sci-Tech",
    "slug": "the-hindu-sci-tech",
    "url": "https://www.thehindu.com/sci-tech/technology/binance-reveals-hackers-used-fake-job-interviews-malicious-code-in-6-billion-heist/article71663791.ece"
  },
  "original_language": "en",
  "account": "On October 29, Binance suffered a massive $6 billion cryptocurrency hack. The FBI has linked the attack to North Korea-affiliated hackers. Binance recovered 98% of the stolen funds through its own resources, with the remaining amount involving less common currencies.\n\nThe hackers employed two deceptive tactics: fake job interviews and malicious code. In June, they lured a platform engineer by duping him into downloading a virus-ridden version of programming software. In September, they approached another engineer via a legitimate job-search site, promising an interview at a fake company.\n\nDuring a four-hour period, the hackers built trust with the engineers through social media interaction. They asked the engineer to download a test exercise as part of the interview. This exercise contained malware that replaced a legitimate development tool component with a malicious version.\n\nThis malware established a connection with Binance's internal systems, granting the hackers control. On October 20, the attackers used this access and an internal AI tool to gain control over software used by two engineers. On the ninth day, they activated the malware, initiating the $6 billion heist.",
  "summary": "Around $2.85 billion of the stolen $6.34 billion has been frozen, Binance said, meaning that the attackers could not use it or convert it to another currency",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}