A fake job interview and the $6.34 billion Binance heist

On October 29, 2026, attackers moved about $6.34 billion in digital assets out of Binance, in the largest crypto theft on record. A fake job interview opened an important way in, but the exchange’s initial technical account points to an operation lasting months, with compromised computers and access to the transaction signing service. As of November 4, no independent final report had been published.

How was the fake job interview set up?

The trap was built around a professional process that looked normal, not around an obviously suspicious message. Someone posing as a project manager approached a Binance software engineer through a legitimate job search platform. The candidate’s profile mentioned his experience at the exchange.

A live video interview followed with a supposed human resources representative. She shared a social media account with personal photos and videos, apparently to bolster her credibility. In the second interview, held over a chat app, the supposed CEO of the fictitious company appeared.

Finally came the technical test: a coding exercise from an online code repository. The employee downloaded it onto his work computer. During setup, code ran that, as Binance describes it, installed previously unknown malware and evaded the device’s security tools.

The malware replaced part of a legitimate development tool, allowing commands from the attackers’ server. They weren’t after a wallet password. They had gained a foothold on a computer inside the company.

The timeline from the first infection to the theft

The fake interview was an intermediate stage of an operation that, according to Binance, had started at least as early as June. The three engineers involved are referred to as A, B and C; their names have not been made public.

1. June 2026 Engineer A, a member of the wallet infrastructure team, downloaded a tampered installation of Homebrew, a software package manager. Binance detected the anomaly, replaced the device and changed related credentials, but believes his role and colleagues had already been exposed.
2. September 2026 Engineer B went through the fake interviews and downloaded the infected coding exercise onto his work computer.
3. October 20, 2026 From B’s computer, and through an internal tool, the attackers allegedly gained control of A’s and C’s computers. On A’s device they found a digital credential that allowed the installation of a software container, that is, an isolated environment for running applications.
4. October 29–30, 2026 The attackers used C’s computer and A’s credentials to run a malicious program. The last unauthorized transfer was finalized at 23:56 UTC, and the malicious authorization on Ethereum was removed at 00:10 UTC on October 30.
5. October 31–November 1, 2026 The FBI publicly attributed the attack to North Korea. Withdrawals resumed gradually, and by late November 1 Binance reported withdrawals of about $4.65 billion and deposits of $1.01 billion.
6. November 3, 2026 Binance published its initial findings, announced the replacement or rebuilding of affected systems and said it was working with independent security firms on an audit.

Regarding the June incident, a source familiar with the case told Reuters that the malicious installer had been placed in a search ad, above the legitimate version. The exact mechanism for moving between computers remains insufficiently explained in the public account.

Why didn’t freezing withdrawals stop the attack right away?

Suspending withdrawals did not cancel the authorizations already created on the blockchain. That difference explains why shutting the normal customer exit was not enough.

The attackers gained unauthorized access to an internal transaction signing service. Between 20:05 and 20:09 UTC on October 29, five internet-connected wallets, so-called hot wallets, sent 233.46 million XRP to an attacker address. Other transfers included about 970,500 SOL, 44.2 million OP and 18,270 bitcoin. An internal alert for large transfers triggered the investigation.

On Ethereum, the EIP-7702 authorization mechanism was exploited so that the attackers’ smart contract gained partial execution rights over a Binance wallet. The company reports 50 signing transactions to manipulate the transaction sequence and install malicious authorizations.

Think of a business that closes its cash register while someone already has authorization to make a payment elsewhere. Closing the register doesn’t revoke the authorization.

The wallet used multi-party computation, so that no single private key is stored in one place. Binance says this complicated immediate revocation. The last transfer, 2,961.9 ETH, had been broadcast earlier and remained pending until it was finalized.

How much money was frozen and who covers the loss?

Binance reported about $2.85 billion frozen or intercepted as of November 3, but that doesn’t mean it had been returned. An earlier update spoke of a rounded $3 billion, while valuations are subject to reconciliation and price changes.

Tether CEO Paolo Ardoino said the company froze more than $1.5 billion linked to the incident. Stablecoin issuers, that is, issuers of tokens that aim for a stable value against a reference asset, can have such capabilities. Bitcoin has no equivalent central issuer that can simply freeze coins.

Co-CEO Richard Teng said Binance will cover the losses with corporate funds and the SAFU user protection fund. The announcement that 98% of the affected tokens had been replenished by October 31 referred to replacing assets, not recovering 98% of the stolen funds. Nor does the remaining unfrozen amount automatically equal a realized gain for the attackers.

CoinDesk identified an empty wallet in earlier proof-of-reserves disclosures listed as backing customer balances. The company’s commitment to absorb the loss therefore carries real weight for users.

Who is behind the attack?

The FBI attributes the theft to North Korean activity it calls TraderTraitor, while Pyongyang denies involvement. Kim Yo Jong called the accusation a provocation, without publishing any technical rebuttal.

The US agency published suspected addresses and reported that the stolen funds were mainly converted into ether, but not the full body of evidence behind the attribution. Previous cases and similarities in methods provide context, not standalone proof for this attack.

Was it one employee’s fault or the security controls?

Our position is that tricking the employee explains one way in, not the entire failure of the controls. It has not been publicly established that he knowingly violated any specific policy.

Binance describes a persistent operation and says it thwarted 57 suspected threats linked to North Korea in 2026. At the same time, experts had warned about fake interviews for years. Chainalysis attributes losses of more than $14.3 million over the previous 18 months to similar schemes. DTEX’s Michael Barnhart described to Reuters a barrage of attempts against Binance.

All this shows both pressure and prior knowledge of the risk. Completing the theft required other computers, credentials, access to signing and permissions on the blockchain. That is where we look for answers about system segregation and emergency revocation procedures.

For users in Greece, the core point is the same: a corporate promise to cover losses doesn’t replace secure custody. An independent audit explaining which safeguards were in place and how they were bypassed could change our assessment. Until then, “the interview was to blame” leaves half the story out.