Binance’s record-breaking crypto theft began with a surprisingly human weakness: a convincing job interview. Attackers posing as recruiters allegedly used a fake company, video calls, social-media profiles, and a coding assignment to plant malware on an engineer’s work computer before reaching the exchange’s wallet infrastructure. The incident affected roughly $6.34 billion in digital assets, making it one of the largest financial heists ever reported.
Binance’s own account of the attack describes a multi-stage operation rather than a single phishing trick. In September, an engineer was contacted through a legitimate job-hunting platform by someone claiming to represent a fictitious company. After an initial video interview with a supposed human-resources representative, the engineer was asked during a second interview to download a code repository as an “assignment.” The repository contained malware that executed during installation, using obfuscation and a tampered development-tool component to evade endpoint defenses.
The compromise then spread. Binance says the attackers used the infected machine to reach two wallet engineers’ devices through an internal artificial-intelligence tool. They eventually obtained access to a wallet signing service and used stolen credentials to deploy a malicious container. On October 30, the attackers moved assets from Binance hot wallets across several blockchains, including 18,270 BTC, approximately 970,500 SOL, 44.2 million OP, and 233.46 million XRP. They also abused Ethereum’s EIP-7702 authorization system, submitting transactions that granted a smart contract controlled by the attackers partial execution rights over affected wallets.
The technical detail matters because shutting down ordinary withdrawals could not immediately stop authorizations that had already been recorded on-chain. Binance says the attackers submitted 50 signed transactions to manipulate account nonces and establish malicious delegations. Since the hot wallets used multiparty computation rather than one conventional private key, the exchange needed a separate on-chain process to revoke those permissions. Binance says it froze or intercepted approximately $2.85 billion and identified no further unauthorized transfers after the final transaction was completed.
The U.S. Federal Bureau of Investigation has attributed the operation to North Korea, whose state-linked hacking crews have repeatedly targeted cryptocurrency companies to generate revenue for the regime. Binance says its security team detected and blocked 57 suspected North Korea-linked incidents during 2026 before this breach, underscoring how recruitment scams, poisoned software, and fake developer tools have become part of the industry’s routine threat landscape.
Binance says it will cover the loss rather than pass it to customers, has replenished 98 percent of the affected token assets, and is purchasing the remaining less-liquid assets. The exchange also says it rebuilt compromised wallet and AI systems, replaced affected devices, revoked credentials, strengthened wallet controls, and expanded behavioral anomaly detection. An independent cybersecurity review is planned, but the larger lesson is already clear: even heavily protected financial infrastructure can be reached through an employee’s ordinary career search when a malicious “take-home assignment” looks authentic enough.
