Binance says fake job interviews were part of $6.3bn crypto hack

The cryptocurrency exchange Binance has set out in a preliminary report how an attack took place that ended with assets worth $6.3bn being taken on 29 October 2026. According to media reports, it is the biggest theft in crypto history. Binance said one route into its systems was fake job interviews.

How the attack unfolded

According to the company, the operation lasted several months. In June, a developer on the team responsible for wallets downloaded a fake tool that used artificial intelligence. Binance detected this, replaced the tool and changed the credentials. However, the hackers could still see the login details of that employee and other team members.

In September, a second engineer who was looking for a new job was invited to interviews. They found them through a legitimate job-hunting platform. They met virtually with people posing as company representatives, including its chief executive. The company was fictitious. After the interview, the engineer downloaded a repository containing malicious code onto their computer.

On 20 October 2026, the attacker used the infected computer and an internal tool based on artificial intelligence. This let them take control of the wallet developer's system and of a second developer on the same team. Nine days later, funds were taken out of the wallets.

Consequences and suspicions

After the attack, Binance suspended withdrawals and the price of bitcoin fell below $77,000. The company says it will cover the losses and that customers' funds are safe. Polish media, citing experts quoted by Reuters and Bloomberg, write of a possible trail leading to hackers from North Korea. This is so far the view of experts, not a finding confirmed in the company's report. Binance's report is preliminary.

What this means for you

The attack targeted a large exchange, but the pattern is a familiar one and could affect anyone who looks for work online. Fake recruiters can make contact through genuine job-listing sites, and a video call is no guarantee that the company exists. Take particular care if, after an interview, someone asks you to download files, tools or code for a "recruitment task". It is best to check such files, and if in doubt to run them only on a device not linked to work or to financial accounts. Before an interview, it is also worth verifying the company in official registers and on its own website.