How a Fake Job Interview Led to a $6.3 Billion Binance Heist

The breach began months prior to the theft, as North Korean hackers targeted Binance engineers through persistent social engineering. One engineer inadvertently exposed their team’s internal roles after downloading a malicious installer disguised as an AI coding tool. While that initial attempt failed to breach the core system, it provided attackers with the roadmap needed to identify key personnel within the company’s wallet infrastructure.

In September, the attackers refined their approach. A Binance engineer engaged with a nonexistent company through a job-hunting platform, completing multiple interview rounds to establish rapport. The trap was sprung when the supposed recruiter requested the engineer download a technical assignment containing malicious code. Once executed, the software granted the hackers remote control over the employee’s machine. From there, the attackers pivoted through the network, hijacking the credentials of two other employees. By late October, the intruders had secured sufficient access to execute the multi-billion dollar transfer. Binance has since confirmed that $2.85 billion of the stolen funds have been intercepted or frozen, and the exchange has pledged to reimburse affected users for the remaining losses.