Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

Binance Details How Fake Interviews Led to $6.43 Billion Theft

Part of the Binance story · since 30 Oct

Developinglatest 2 hours ago19 articles11 outlets
30 Oct · Security Affairs first2 Nov3 NovNowThis article19th of 19
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft. This article, 19th of 19.

Binance has disclosed that the record-breaking loss of about $6.43 billion in assets resulted from a multi-stage campaign rather than a single breach. The company describes the attack as a supply-chain and social-engineering operation that combined trojanised software, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. The sequence began in June 2026 with a Wallet DevOps engineer (Engineer A) who downloaded a trojanised Homebrew installer to obtain an AI tool.

After initial credential rotation, Binance said information linked to Engineer A and related wallet infrastructure staff was exposed to the attacker.

A second phase occurred in September 2026, when the threat actor posed as a Project Director on a recruitment platform and arranged two interview rounds with a Binance employee (Engineer B). During the first round, a HR representative shared a social media account to build credibility; the second round occurred via a social chat app. Engineer B was instructed to download an “assignment” containing a malicious code repository, which executed during setup and initiated a chain of unauthorized activities.

The malware used obfuscation and evasion techniques, replaced a legitimate tool component with a poisoned version, and communicated with a defender-controlled server, while also attempting to erase forensic traces. In October 2026, the attacker leveraged Engineer B’s machine to access Engineer A and Wallet Engineer C, deploying a container and triggering a script that exploited an internal wallet signing service to initiate covert transactions outside the normal withdrawal process.

Binance says it has reconstructed the affected wallet environment, rebuilt the internal AI tool and tightened access controls, while decommissioning credentials, replacing devices and enhancing detections. The firm notes that entry points have been closed and assets are being traced with law enforcement and partners.

How the story developed

All 19 articles
Developinglatest 2 hours ago19 articles11 outlets

19 articles from 11 outlets since 30 Oct. Still developing; the latest report was 2 hours ago. This was the 19th report, 5 days after the first.

Now30 Oct311 Nov23First reportSecurity Affairs · 30 Oct, 00:30This article19th of 19 · day 4
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft. This article, 19th of 19.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 19 articles as a list
  1. Fri 30 OctDay 011
    1. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion00:30 · Security Affairs · First report
    2. Binance investigates suspected hot wallet breach and transfers02:00 · SecurityOnline
    3. Binance reports breach affecting $6.3 billion in assets06:00 · The Hacker News
    Show 8 more from 30 Oct
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    4. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    5. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    6. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica
    7. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs
    8. Binance hack highlights risks to developer machines and signing23:00 · StepSecurity
  2. Sun 1 NovDay 23
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. How North Korea is laundering $6.4 billion stolen from Binance09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  3. Mon 2 NovDay 33
    1. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    2. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading
  4. Tue 3 NovDay 42
    1. FBI attributes $6.3 billion Binance heist to North Korea10:30 · SecurityOnline
    2. Binance Details How Fake Interviews Led to $6.43 Billion Theft18:00 · The Hacker News · This article, 19th of 19

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in