Binance details how fake job interviews enabled $6.3bn crypto theft

How the breach unfolded

Binance, the world’s largest cryptocurrency exchange, says a “serious and highly sophisticated security incident” allowed hackers to steal a record $6.3 billion (£4.7 billion) from its wallets.

Step‑by‑step attack

Initial contact: An engineer was approached on a legitimate job‑hunting platform and invited to fake interviews with actors posing as company representatives.

Trust building: The impostors shared social‑media accounts containing personal images to gain the engineer’s confidence.

Malware delivery: During a second interview the engineer was asked to download what was presented as an “assignment.” The file contained obfuscated malicious code that evaded detection.

Tool compromise: In October the attackers used the compromised computer and a breached internal AI tool to take control of two additional engineers’ laptops.

Fund extraction: With control of the engineers’ machines, the hackers executed the final stage of the operation, draining billions of dollars worth of crypto from Binance’s wallet.

Immediate response

Binance suspended withdrawals for customers worldwide, preventing users from moving crypto out of the platform until service was restored on Sunday. After reopening, customers withdrew billions of dollars worth of assets.

Aftermath and remediation

The exchange apologized for the “concern, disruption and uncertainty” caused to users, partners and the wider industry. It said it is working with law‑enforcement agencies to trace and freeze the stolen assets.

Binance also announced that it has set aside more than 100 % of the funds needed to cover the loss, and that 98 % of the token assets impacted had been replenished as of Saturday.

Binance described the attack as a “sophisticated, multi‑stage campaign” that employed malicious software downloads to compromise engineers’ computers and gain control over internal tools.