Binance Hack Exposed: How Fake Job Interviews Led to a $6.34 Billion Crypto Theft
Binance said a fake job interview campaign led to the Oct. 29, 2026 Binance hack, a security incident that impacted about $6.34 billion in digital assets and let attackers abuse an internal wallet signing service to send crypto from multiple hot wallets. The company said the attack started months earlier with a tampered software install and later expanded through social engineering, malware, an internal AI tool, and stolen engineer access.
Key Points
- Binance said attackers used fake recruiter interviews and malware to compromise engineers before launching the Oct. 29 theft.
- The company said about $6.34 billion was affected. Earlier updates put the impact at around $6.3 billion.
- Binance said it has frozen or intercepted about $2.85 billion so far, while an earlier update said about $3 billion had been frozen on-chain.
- The FBI said North Korea was behind the attack and published crypto addresses tied to the stolen funds.
- Binance said it rebuilt affected systems, tightened controls, and will cover losses from its SAFU fund and company funds.
How the attack started
According to Binance, the attack was a multi-stage campaign rather than a single breach or simple phishing incident. The company said it involved fake recruitment interviews, malicious software downloads, a compromised internal AI tool, endpoint compromise, and an advanced transaction authorization method.
Binance said the earliest known stage happened in June 2026, when Wallet DevOps Engineer A downloaded a tampered Homebrew installation while trying to install a popular AI coding tool found through a search engine. Binance said its security team detected the anomaly, replaced the device, and rotated related credentials, but the engineer’s role and nearby colleagues on the wallet infrastructure team were exposed to the attacker.
Binance said the next major stage began in September 2026, when Software Engineer B was contacted on a legitimate job-hunting platform by someone posing as a project director.
According to Binance, a fake HR interview was followed by a second interview with a person claiming to be the CEO of a fictitious company. Binance said the fake HR interviewer shared a social media account with personal photos and videos to build trust, which it described as more advanced and deceptive than earlier social engineering. The second interview took place in a popular social chat app, and near the end the attacker told Engineer B to download an “assignment” containing a malicious code repository onto a work computer.
Binance said the malware executed during setup and used obfuscation and evasion techniques. The company said the code replaced a legitimate development tool component with a malicious version, reached out to an attacker-controlled external server, and was not detected by endpoint security tools at the time because it was a 0-day. Binance also said the attacker tried to hide activity and remove traces.
Binance said file operations on the compromised system showed the attacker created /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_, deleted the valid pyenv binary, renamed the new file into place, deleted /opt/homebrew/bin/pyenv, and then created a new symlink before spawning zsh. These steps replaced a legitimate tool component with a malicious version, according to the company.
How the theft happened
Binance said the attacker used Engineer B’s computer and an internal AI tool on Oct. 20, 2026 to gain control over Wallet DevOps Engineer A and Wallet Software Engineer C. The company said the attacker found a container deployment permission token on Engineer A’s computer.
According to Binance, the final attack reached wallet signing operations on Oct. 29. The company said that between 17:15 UTC and 19:56 UTC, the attacker logged onto Engineer C’s computer, used credentials stolen from Engineer A, deployed a container, and triggered a malicious script to launch the theft.
Binance said the attacker exploited unauthorized access to an internal wallet signing service to initiate transactions outside the normal withdrawal process. In updates on Oct. 30, the company said its initial investigation suggested a compromised DevOps engineer’s laptop gave the attacker access to a service container and let them submit unauthorized withdrawal transactions, and that it had found no evidence of any wallet private key leak.
According to Binance, five hot wallets sent 233.46 million XRP to an attacker-controlled address between 20:05 UTC and 20:09 UTC. The company said hot wallets on Solana and Optimism sent about 970,500 SOL and 44.2 million OP to attacker-controlled addresses, and a Binance hot wallet also sent 18,270 BTC to an attacker-controlled address.
Binance said the attacker then used the signing service to exploit Ethereum’s EIP-7702 authorization mechanism, which lets an account delegate certain execution rights to a smart contract without exposing the private key. According to the company, the attacker used that feature to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet and submitted 50 signing transactions to manipulate the account nonce and set the malicious delegations.
Binance said the hot wallet used Multi-Party Computation, or MPC, so there was no single private key that could be used to immediately revoke the malicious EIP-7702 authorizations. The company said the final unauthorized transfer of 2,961.9 ETH finalized on-chain at 23:56 UTC.
Binance’s Response
Binance said the estimated total impact sat at around $6.3 billion in its Oct. 30 updates, and it later said approximately $6.34 billion in digital assets were impacted.
The company said about $3 billion had been frozen on-chain as of the Oct. 30 updates, and its later Nov. 3 report said approximately $2.85 billion had been frozen or intercepted, subject to reconciliation and market price volatility. Binance apologized for the concern, disruption, and uncertainty the incident caused users, partners, and the wider industry.
Binance said it temporarily suspended withdrawals while security checks were completed, revoked the affected address authorization, and engaged law enforcement and blockchain intelligence partners to trace and recover funds. The company also said it would cover all losses from the SAFU fund and company funds and that user funds were safe.
According to Binance, the entry points used in the attack have been closed, systems touched in the attack path have been rebuilt or replaced, and tighter device controls, stronger wallet-service risk controls, and expanded AI-based behavioral anomaly detection have been put in place.
Binance said that by Nov. 3 it had rebuilt the affected wallet system in a new environment, rebuilt the affected internal AI tool and access controls, decommissioned credentials and tokens related to affected engineers, and completed enhanced security scans across all employee devices.
The Federal Bureau of Investigation said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29, 2026 and said it tracks this activity as TraderTraitor. The FBI said, together with the United States Secret Service and IRS Criminal Investigation, it observed the actors converting stolen assets primarily into Ethereum and expected the funds to be further laundered through DeFi and instant swap services. The bureau also published a list of wallet addresses that it said are holding or have held assets from the theft and are operated by or closely connected to North Korean TraderTraitor actors.
To learn more about staying safe online, read our guide on how to protect yourself from cyberattacks.
Organizations can also refer to our guide on responding to a cybersecurity incident for practical steps to manage security incidents like binance crypto theft.
About the Author
