Fake Job Interview Behind $6.3 Billion Binance Hack

Two interviews, one technical assignment, and several months of preparation. The attack on Binance began with what appeared to be an ordinary job offer.

In September 2026, a Binance software engineer received a job offer through a popular recruitment platform.

Two video interviews followed. The first was with a human resources representative, and the second with someone posing as the company's CEO.

Everything seemed legitimate. The company had a social media presence, photos, videos, and employees who answered his questions.

Finally, the engineer received a technical assignment. He was asked to download some code and run it on his computer.

But the company was fake. The interviews were staged, and the code contained malware.

This gave the attackers access to the engineer's work device. According to Binance's investigation, this was one of the key moments in the preparation of the October 29 attack, which affected crypto-assets worth approximately $6.34 billion.

The preparations began back in June

However, the fake job interview was not the first attempt to infiltrate Binance's systems.

Back in June, another employee downloaded a modified software tool while attempting to install an AI-powered coding application.

Security systems detected the threat. The computer was replaced, and access credentials were changed.

According to Binance, however, the attackers had already managed to gather information about the employee and his colleagues.

This information helped them continue their operation over the following months.

From an infected computer to access to billions

Following the successful fake interview, the attackers had a new opportunity to penetrate deeper into Binance's internal infrastructure.

On October 20, they used the compromised devices and an internal AI tool to gain access to the systems of two additional engineers.

Their target was the infrastructure Binance used to manage and authorize crypto-asset transactions.

This is one of the most important details in the entire story.

The attackers did not compromise the blockchain networks themselves. They targeted the systems through which the company managed its funds.

Nine days later, the transfers began.

Four minutes, 233 million XRP

On October 29, between 20:05 and 20:09 UTC, the attackers transferred 233.46 million XRP from five Binance wallets to an address under their control.

Transfers of Bitcoin, Ethereum, Solana, and other crypto-assets followed.

Binance's security systems detected the unusual activity. The company began freezing funds, restricting access, and suspending withdrawals.

But the attackers had already established transaction authorizations that did not depend on the standard withdrawal process.

Even after withdrawals were suspended, the attack continued.

The technical teams had to take additional measures to revoke these authorizations. Meanwhile, unauthorized transfers continued for nearly four hours.

What happened to the billions?

According to Binance's November 3 report, the total value of the affected crypto-assets reached approximately $6.34 billion.

Of that amount, approximately $2.85 billion was frozen or intercepted.

The company also reported that, as of October 31, it had replenished approximately 98% of the affected tokens in customer balances using its own funds and reserves.

However, this does not mean that all the stolen funds had been recovered from the attackers.

The US Federal Bureau of Investigation (FBI) linked the attack to the North Korean hacking group TraderTraitor. North Korea denied the allegations.

The biggest weakness isn't always in the technology

This story demonstrates just how sophisticated modern cyberattacks can be.

The attackers did not rely on a single breach. Over several months, they gathered information, built trust, and searched for ways to reach the company's most sensitive systems.

It all began with actions that, taken individually, could have appeared completely harmless.

And that is the key takeaway.

A blockchain network can function flawlessly while the systems surrounding it remain vulnerable.

That is why crypto-asset security depends not only on technology, but also on people, procedures, and how access to funds is managed.