Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Binance details how fake job interviews enabled a $6.34B hack

Part of the Binance story · since 30 Oct

Developinglatest 2 hours ago20 articles11 outlets
30 Oct · Security Affairs first2 Nov3 NovNowThis article20th of 20
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack. This article, 20th of 20.

Binance has detailed how a multi-stage cyber operation in October 2026 enabled attackers to siphon about $6.34 billion in digital assets, using fake recruitment interviews, malware downloads, compromised developer tools, and abuse of an internal AI application. In June 2026, an engineer on Binance’s Wallet DevOps team downloaded a tampered Homebrew installation while seeking an AI coding tool, triggering the initial foothold.

The attackers then pursued another engineer via a legitimate job platform, staging two interviews with a fake HR contact and a purported CEO. At the end of the second interview, the target was shown a “technical assignment” containing a malicious code repository that, when opened, replaced a legitimate development tool component with a malicious version and concealed activity through obfuscation.

By October 20, the compromise extended to additional staff, including Wallet DevOps Engineer A, after attackers leveraged an internals AI tool to move laterally. They discovered a container deployment permission token on Engineer A’s machine and, on 29 October, used stolen credentials to access another engineer’s computer, deploy a container and run a malicious script.

This granted access to Binance’s internal wallet signing service, enabling on-chain transfers across multiple networks: five hot wallets sent 233.46 million XRP, with other transfers totalling roughly 970,500 SOL, 44.2 million OP and 18,270 BTC.

Binance notes an on-chain EIP-7702 authorization was misused to grant a malicious smart contract partial execution rights over a hot wallet, with MPC preventing immediate revocation and the final transfer of 2,961.9 ETH completed at 23:56 UTC on 29 October; the last malicious on-chain authorization was revoked at 00:10 UTC on 30 October.

The firm attributes the attack to North Korea-linked TraderTraitor (Lazarus Group/APT38) per FBI attribution, with a broader note that Binance absorbed the financial impact, replenishing 98% of affected assets, and rebuilding affected systems while engaging independent security firms. Binance also reports detecting and preventing 57 suspected North Korea-linked threat cases during 2026, including fake interviews and compromised tools.

The company emphasises that recruitment processes and internal tooling form part of the attack surface and warrants tighter controls and isolated environments for technical assignments.

How the story developed

All 20 articles
Developinglatest 2 hours ago20 articles11 outlets

20 articles from 11 outlets since 30 Oct. Still developing; the latest report was 2 hours ago. This was the 20th report, 5 days after the first.

Now30 Oct311 Nov23First reportSecurity Affairs · 30 Oct, 00:30This article20th of 20 · day 4
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack. This article, 20th of 20.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 20 articles as a list
  1. Fri 30 OctDay 011
    1. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion00:30 · Security Affairs · First report
    2. Binance investigates suspected hot wallet breach and transfers02:00 · SecurityOnline
    3. Binance reports breach affecting $6.3 billion in assets06:00 · The Hacker News
    Show 8 more from 30 Oct
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    4. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    5. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    6. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica
    7. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs
    8. Binance hack highlights risks to developer machines and signing23:00 · StepSecurity
  2. Sun 1 NovDay 23
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. How North Korea is laundering $6.4 billion stolen from Binance09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  3. Mon 2 NovDay 33
    1. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    2. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading
  4. Tue 3 NovDay 43
    1. FBI attributes $6.3 billion Binance heist to North Korea10:30 · SecurityOnline
    2. Binance Details How Fake Interviews Led to $6.43 Billion Theft18:00 · The Hacker News
    3. Binance details how fake job interviews enabled a $6.34B hack20:30 · Security Affairs · This article, 20th of 20

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in