A fake interview costing $6.3 billion. How hackers robbed Binance

On October 29, hackers stole $6.3 billion in digital assets from the Binance crypto exchange. This became the largest theft in cryptocurrency history. The FBI blamed the TraderTraitor hacking group, linked to North Korea, for the attack.

However, how did the criminals manage to gain access to the systems of a company that processes billions of dollars daily and invests significant funds in cybersecurity?

Binance provided the answer to this question after an internal investigation. It turned out that the hackers did not act for just one day but prepared the attack for several months. Moreover, one of their main tools was a seemingly ordinary deceptive job interview.

The first step was taken back in June. One of Binance's engineers downloaded a malicious version of a program modified by the attackers, which contained harmful code. The company's security system noticed the threat, and the employee's computer was replaced.

But it was too late. The hackers had already managed to obtain information about the engineer's responsibilities and those of his colleagues who worked on the crypto-wallet infrastructure.

In September, the criminals chose a new target — another Binance engineer. They contacted him through a job search platform and offered him an interview with another company. It is unknown whether the employee himself was looking for a new job or was simply interested in the offer.

The person who contacted the engineer introduced himself as a project manager at a company that did not actually exist. During the first interview, he showed his social media profile with personal photos and videos to gain trust.

During the second interview, conducted by a person posing as the CEO of this company, the engineer was asked to download a test assignment. It contained malicious code.

When the engineer downloaded the files, the hackers gained access to his computer. This time, Binance's security system did not detect the threat.

Using the infected computer and Binance's internal artificial intelligence tool, the criminals were able to gain control over the computers of two more engineers. One of them was the same employee who had downloaded the infected program back in June. He had the right to publish program code, and the hackers exploited his privileges.

On October 29, the criminals connected to the third engineer's computer and launched the malicious program, through which they carried out the theft.

According to Binance, after the theft, it rebuilt its crypto-wallet systems and internal artificial intelligence tools, and also engaged external cybersecurity specialists. The exchange also announced that it had allocated sufficient funds to cover user losses and restored the ability to withdraw money.

However, the scale of the threat remains large. According to Binance co-head Yi He, in 2026 alone, the company detected and neutralized 57 suspicious cyberattacks linked to North Korea. Most of them were successfully stopped. But, as the latest hack showed, it only takes missing one attack for the consequences to be catastrophic.

• 0
• 0
• 0
• 0
• 0
• 0
• 0
• 0