$6.34 Billion Stolen in Binance Hack via Fake Job Interviews
Hackers stole $6.34 billion from Binance during a four-hour breach on October 29 using malicious code delivered through fake job interviews. Global cryptocurrency investors and platform engineers faced sudden fallout as the unprecedented heist forced temporary withdrawal disruptions and triggered sharp price drops across major crypto assets.
Malicious Code Followed Months of Social Engineering Targeting Staff
Binance reported that 98 percent of affected customer assets have been replenished using the exchange’s own funds, while $2.85 billion of the stolen total remains frozen. Customers withdrew $4.72 billion in the wake of the security failure, which the US Federal Bureau of Investigation (FBI) attributed to North Korea-linked hackers. Pyongyang rejected the findings, with the sister of leader Kim Jong Un describing the claims as absurd rhetoric.
The investigation revealed that attackers laid groundwork for the breach as early as June by tricking a platform engineer into downloading a compromised version of the Homebrew programming software. Although cybersecurity teams removed that initial malware, the actors returned in September via a legitimate job-search platform, offering another engineer a position at a fictitious company. After building rapport through shared social media photos and videos, the attackers persuaded the target to download a test exercise containing advanced obfuscation and evasion techniques.
By October 20, the unauthorized access allowed perpetrators to exploit an internal AI tool and seize control of software operated by two additional engineers. Those compromised systems executed the malicious code that triggered the wider attack nine days later.
