Binance Hack: How Fake Job Interview and Tampered Software Led to $6.3 Billion Crypto Theft

TLDR:

• Hackers compromised two Binance engineers through a tampered tool in an ad and a fake job interview. 
• Attackers moved 233.46 million XRP from five hot wallets in four minutes on October 29, Binance said. 
• Binance froze about $2.85 billion, yet transfers continued nearly four hours after the attack began. 
• Binance is repaying customers and investing in AI-enabled detection and a security research fund.

Binance hack details have emerged after the exchange published its initial security report on Tuesday. Attackers used a fake job interview and tampered software to compromise engineer computers.

They then drained crypto worth $6.3 billion on October 29. The FBI has blamed a North Korean hacking group, while Pyongyang rejects the claim.

Binance has said it is repaying all customers whose funds were stolen. The report traces the breach back to June.

How the Attack Began in June

The Binance hack started in June, according to the exchange’s report. An employee on the wallet developer team downloaded a tool that hackers had tampered with.

Binance detected the problem afterward, replaced the device, and changed credentials. However, the employee’s role and those of other wallet team members stayed exposed. The report describes a multi-stage operation that built up over several months.

A person familiar with the incident said the malicious version sat inside an advertisement. As a result, it appeared higher in search results than the real tool.

Meanwhile, Michael Barnhart, a researcher at cybersecurity firm DTEX, said fake job interviews are a well-known hacking technique.

In September, a second software engineer downloaded a malicious code repository after a job interview. The candidate believed the role was legitimate. The interview included a virtual meeting with the CEO of a fictitious company.

From Compromised Computers to the Theft

On October 20, the attacker used the compromised computer and an internal AI tool. This gave control over the wallet developer’s system and that of a second wallet developer.

Nine days later, the attacker used the second developer’s computer. Stolen credentials from the first developer helped trigger a malicious script.

The attack unfolded quickly on October 29. Attackers moved 233.46 million XRP from five hot wallets to an attacker-controlled address within four minutes. They later withdrew other cryptocurrencies, including bitcoin.

Few engineers at the company have direct access to wallets, according to a person familiar with the Binance hack. Binance said the attackers used 50 signing transactions to manipulate the account.

Binance Response and Next Steps

Binance received an internal alert about large transfers and began investigating. The exchange suspended withdrawals, froze affected tokens, and removed unauthorised permissions.

These steps left about $2.85 billion in frozen assets. However, suspending withdrawals alone could not stop every unauthorised movement.

Binance also had to build new procedures to revoke authorisations, which slowed its response. Meanwhile, the final unauthorised transfer took place at 2356 GMT, nearly four hours after the attack began.

Following the Binance hack, the exchange apologised to users, partners, and the wider industry. In its report, Binance stated, “This should not have happened.”

The exchange also said it prevented 57 suspected North Korea-linked cyberthreats in 2026. Barnhart said Binance is “just getting barraged.”

Binance said it is increasing investment in AI-enabled detection. It is also working on a security research fund and targeted initiatives with leading AI companies.

The post Binance Hack: How Fake Job Interview and Tampered Software Led to $6.3 Billion Crypto Theft appeared first on Blockonomi.