From dream job pitch to $6.3 bn heist: How fake interviews fuelled the biggest crypto hack

Binance $6.3 billion heist started with a simple job interview, leading to a massive crypto theft that sent shockwaves through the industry. Hackers reportedly spent weeks masquerading as recruiters and fake executives before convincing an engineer to download malicious software onto a work computer, Binance revealed on X.

Must read: North Korea denies role in $6.3 billion Binance hack, calls claim a ‘grave political provocation’

How did hackers manipulate a Binance engineer?

Binance revealed that hackers approached its engineer on a job-hunting platform in September. They presented themselves as a fictional company and introduced themselves as a project director. The engineer's profile mentioned his experience at Binance, making him an attractive target because of his access to the cryptocurrency exchange's internal systems.

Later, the engineer was invited to an initial interview with someone pretending to be an HR representative. “The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches,” Binance stated.

Must read: Hacking scare: Users pull out $3.64 billion from Binance accounts as platform restores withdrawals

For the second interview, the engineer was asked to move to a separate messaging application to speak with someone claiming to be the company's CEO. The fake CEO manipulated the engineer to download an assignment on his Binance work laptop. However, Binance later discovered that the file contained malicious code. By downloading it, the employee potentially gave the attackers a way to compromise the company's systems.

From one laptop to the wallets

However, the interview was not the first attempt; Binance claimed that it had blocked several initial attempts to test its security in June. Hackers later leveraged the compromised laptop to infiltrate other employees’ systems to authorise wallet transactions. Binance says they then exploited an internal AI tool to carry out unauthorised transactions. The theft itself was launched on October 29.

TRM Labs said the attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes. Binance said roughly $3 billion of affected assets that passed through hacker-linked wallets had been identified and frozen.

The FBI linked the hack to North Korea’s “TraderTraitor.” The same unit was behind the 2025 Bybit hack. However, it denied the allegations.  Binance has said users will not bear any losses and that it will cover them. It said it would use its Secure Asset Fund for Users to do so.