Binance Says Fake Job Interview Led to $6.34 Billion Hack

Binance says a single engineer who fell for a fake job interview and downloaded malicious software gave hackers the foothold they needed to steal $6.34 billion from the exchange's wallets, according to a security update the company issued Tuesday and reported by WIRED.

The theft, carried out on October 29, moved funds across more than 10 blockchains in roughly 20 minutes, Binance reported. The FBI linked the attack to North Korea's hackers on October 31, two days after the breach, according to WIRED's account of Binance's disclosure.

How did the attackers get inside Binance's systems?

Binance's internal review traces the intrusion to a staged recruitment scheme. An engineer was approached with what appeared to be a legitimate job interview and, in the course of it, downloaded malicious software, the company said. That download gave the attackers an initial foothold inside Binance's network.

From there, Binance reported, the hackers moved laterally through internal systems, eventually exploiting an internal AI tool and gaining access to a wallet signing service — the mechanism that authorizes outbound transactions. That access let them push transfers outside Binance's normal withdrawal controls. "It was not a single isolated breach or a simple phishing incident," Binance said in its update, as quoted by WIRED.

How long did the hackers spend preparing the attack?

Binance's analysis places the first traceable activity connected to the breach in June of this year, meaning the operation that culminated in the October 29 theft was months in the making, the company reported. Rafe Pilling, a senior director of threat intelligence at the security firm Sophos, told WIRED the pattern matches a known playbook: "The attackers didn't simply steal a wallet key. They compromised engineers, used that access to understand and move through the environment, and ultimately subverted the systems used to authorize transactions."

Who is blamed for the hack, and how certain is that attribution?

Multiple cryptocurrency tracing firms attributed the theft to hackers linked to the Democratic People's Republic of Korea, specifically a group known as TraderTraitor, shortly after funds began moving, according to WIRED. The FBI's attribution followed on October 31. TraderTraitor was previously tied to a hack that stole more than $1.5 billion last year, WIRED reported.

Binance itself stops short of naming TraderTraitor directly. Instead, the company points to the FBI's attribution and notes its own prior encounters with North Korea–linked activity: Binance's security team said it detected and prevented 57 suspected North Korea–linked cyber threat cases throughout 2026, according to the company's update cited by WIRED. The distinction between Binance's cautious internal framing and the FBI's more direct attribution is itself part of the uncertainty in this case — the company is relying on outside law enforcement and tracing firms rather than asserting the link on its own authority.

How much of the stolen $6.34 billion is recoverable?

Of the more than $6 billion taken, almost half was frozen by parts of the cryptocurrency industry where doing so was possible, WIRED reported, citing Binance. That still leaves billions of dollars under the control of the hackers, who are reportedly working to launder the funds into a form that can be cashed out — a process WIRED said could take months.

The numbers

• $6.34 billion — total stolen from Binance wallets, according to the company's security update.
• ~20 minutes — the span over which hackers moved funds across more than 10 blockchains.
• ~50% — the portion of stolen funds frozen by parts of the crypto industry, per Binance.
• 57 — suspected North Korea–linked cyber threat cases Binance says it detected and prevented in 2026.
• June–October 29 — the window Binance's analysis says spans early attack preparation through the final theft.

What has Binance done since the breach?

Binance said it has set aside funds to cover the losses and has "rebuilt or replaced" internal systems affected by the attack, according to its update. "This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company said, as quoted by WIRED.

The episode adds to a string of North Korea–linked thefts targeting the crypto industry over nearly a decade, WIRED noted, with this incident standing as the largest attributed to the country's hackers to date based on Binance's own disclosed figures.