- BIST10011,333+2.81%
- USD50.03+0.05%
- EUR56.26+0.56%
- GOLD4,125.60+1.29%
- INTEREST36.00%-1.00
- BITCOIN76,416-4.99%
- November 5, 202622°
- BIST10011,333+2.81%
- USD50.03+0.05%
- EUR56.26+0.56%
- GOLD4,125.60+1.29%
- INTEREST36.00%-1.00
- BITCOIN76,416-4.99%
- November 5, 202622°
Binance says a fake recruiter's coding 'assignment' let hackers in before $6.3B theft
In its first detailed account of the record heist, Binance said one of its engineers was drawn into a two-round interview with a fictitious company and downloaded malware-laced code onto his work computer. The attackers later used a hijacked internal AI tool to reach the wallet team. The FBI blames North Korea, which denies it.
A job interview that never really existed helped open the way to the largest crypto theft on record, Binance said Tuesday, Nov. 3. In an initial report on the Oct. 29 attack, the exchange said one of its software engineers downloaded a coding "assignment" from a fake recruiter onto his work computer, giving the attackers a foothold they later used to reach its wallet systems.
"This was not a single mistake or a single breach. It was a campaign built over many months," co-CEO Richard Teng said, according to Bloomberg. The company said the incident "should not have happened" and apologized to users.
Two interviews with a company that did not exist
According to Binance, the engineer, whose profile on a legitimate job platform mentioned his work at the exchange, was approached in September by someone posing as a project director. A supposed HR representative interviewed him on live video and, to win his trust, showed him a social media account full of personal photos and videos.
A second round, with a man claiming to run a fictitious company, took place on a chat app. Near the end, the engineer was told to download the assignment. Its code quietly swapped a legitimate developer tool for a tampered copy and connected to an attacker-controlled server. Binance said the previously unknown malware slipped past its endpoint security tools.
From an AI tool to the hot wallets
That was not the first breach. In June, a wallet engineer installed a tampered copy of the Homebrew package manager while setting up an AI coding tool. Binance replaced his device, but his role and his teammates had already been exposed. On Oct. 20, the attackers used the interviewee's infected machine and an internal Binance AI tool to take over that engineer's computer and a colleague's. On Oct. 29 they deployed a container with stolen credentials and ran a script; funds began leaving at 20:05 UTC.
Frozen funds and a denial
Binance put the losses at about $6.34 billion and said $2.85 billion had been frozen or intercepted, below the roughly $3 billion it cited on Oct. 30. It said 98% of the affected tokens had been replenished from its own funds as of Oct. 31; on that day, AP reported, the exchange had cited 90%. The FBI attributes the theft to TraderTraitor, the North Korean group it also blamed for the roughly $1.5 billion Bybit hack in 2025. No arrests or charges have been announced.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the FBI's finding "absurd rhetoric" in a statement carried by state media. President Donald Trump said Saturday: "We don't know if it's North Korea but if it is we'll talk to North Korea about it," Anadolu reported.
Fake recruiters are a familiar North Korean tactic. In 2024 the FBI urged crypto workers to "avoid taking pre-employment tests or executing code on company owned laptops or devices." Binance said it stopped 57 suspected North Korea-linked attacks this year, many using fake interviews or developer tools.
Cover image: Türkiye Gazetesi; graphic: U.S. Secret Service
Stay Updated with Ally Daily
Subscribe to be informed about special news, developments and announcements. We will keep you informed.
By signing up, you agree to our Privacy Policy
