Binance hack: the attack began with a fake job interview

The largest theft in the history of the crypto market started with a job interview. On November 3, 2026, Binance published a first incident report on the hack of October 29. According to the report, the attackers did not reach the exchange's hot wallets with a stolen key but through months of groundwork: a tampered software package in June, a fake hiring process in September and an internal AI tool in October. Binance puts the damage at more than $6.3 billion.

For the exchange's customers, the report changes little about the current situation. Binance says around 98 percent of the affected holdings have been replaced with company funds, and it is reopening withdrawals step by step. The method matters more. The same scheme of fake job offers and poisoned test assignments has been aimed at developers, freelancers and retail investors for years, and a handful of habits are enough to fend it off.

Binance incident report: how the $6.3 billion hack began

Binance released the report on Tuesday through its own channel on X, alongside a press briefing with security chief Jimmy Su, which CoinDesk reported on. In its summary of the report, The Block cites a figure of $6.34 billion. Both outlets describe the same four-stage sequence, which stretched over five months.

On October 30, Binance had briefly attributed the cause to a compromised laptop in the DevOps team. The new report explains how the attackers got hold of that device and why a single computer was enough. Co-CEO Richard Teng summed it up on X, paraphrased: this was neither a single mistake nor a single breach, and the perpetrators had run a campaign over several months.

The four stages at a glance

• June 2026: An engineer on the wallet DevOps team installs a tampered Homebrew package.
• September 2026: A second employee downloads a rigged coding assignment onto his work computer as part of a fake hiring process.
• October 20, 2026: Through this computer and an internal AI tool, the attackers take over the devices of two wallet engineers.
• October 29, 2026, 20:05 UTC: Using stolen credentials, they launch a container running a malicious script, and the funds start to drain.

Fake hiring process: the coding test with zero-day malware

The decisive foothold was gained in September. According to Su, a software engineer was contacted through a genuine job platform. The sender posed as a project manager. A video call followed with a supposed HR manager, who shared a social media profile with private photos to build trust. A purported company chief appeared in a second call.

It ended with a coding assignment of the kind that is common in technical hiring. The engineer downloaded it onto his work computer. According to Su, the file contained zero-day malware that bypassed the device's endpoint protection. A zero-day vulnerability is a flaw the security software vendor does not yet know about, which is why no detection exists for it at the time of the attack.

The pattern is not new. The FBI warning of September 3, 2024 describes exactly this approach: the perpetrators study professional networks, build trust through lengthy conversations, appear as several people and finally get their victims to run code, for example as a hiring test or as debugging with unfamiliar packages.

Tampered Homebrew package: the first breach in June

Homebrew is a widely used package manager for macOS that lets developers install programs from the command line. According to the report as relayed by The Block, an engineer on the wallet DevOps team was looking for an AI coding tool in June and ended up with a tampered installation.

By its own account, Binance spotted the anomaly, replaced the device and rotated the affected credentials. Even so, the attackers now knew who worked on the wallet team and what role the engineer held. That knowledge about people could not be reset. The June incident was therefore no failure for the perpetrators: it gave them the map for their second attempt.

Internal AI tool: hopping from machine to machine

On October 20, the attackers put the computer infected in September to use. Through an internal Binance AI tool, they reached the computers of two engineers on the wallet team. On one of these devices they found a permission to launch containers in the production environment. A container is a self-contained software environment in which a program runs with exactly the rights assigned to it.

Nine days later, on October 29, they used that permission. They launched a container and ran a script inside it that triggered the attack on the wallet infrastructure. According to the report, the AI tool helped both with the jump between computers and with access to the wallets' signing environment.

EIP-7702 and the MPC wallet: containment took just over four hours

According to CoinDesk, funds began leaving the exchange at 20:05 UTC. The attack was not contained until 00:10 UTC on October 30. Su gave the reason at the press briefing: the attackers exploited EIP-7702, an Ethereum extension from the Pectra upgrade that lets a regular account temporarily take on the logic of a smart contract. That gave them execution rights over a hot wallet.

Binance secures its hot wallets with multi-party computation (MPC). The private key never exists in one place; several parties generate every signature jointly. That protects against the theft of a single key. In Binance's case it had a downside: according to Su, no single key could revoke the permission that had been granted, which is why containment dragged on past midnight.

North Korea and TraderTraitor: what the FBI alleges and Pyongyang denies

The FBI attributes the attack to the North Korean group TraderTraitor. In its report, Binance itself speaks of social engineering, malware and compromised AI tools, and says it has already repelled 57 suspected North Korean attack attempts using similar methods in 2026.

North Korea rejects the attribution. According to The Block, the sister of leader Kim Jong-un on Monday called the FBI's claims a "grave political provocation." There is so far no solid evidence pointing to anyone else; the attribution remains an assessment by US authorities.

Frozen, replaced, SAFU halved: where Binance customer funds stand

Binance says it has frozen or intercepted around $2.85 billion and topped up about 98 percent of the affected holdings with company funds. Teng stresses that users are not affected by the loss. Since 04:00 UTC on November 3, the exchange has been reopening withdrawals in phases for dozens of tokens on BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base. The tokens with the highest demand over the past week came first. After that, hourly deposits exceeded withdrawals, according to Binance.

To compensate users, Binance is also drawing on the SAFU fund, the exchange's emergency fund for user losses. According to CoinDesk, citing data from mempool.space, the fund's bitcoin holdings fell from 15,000 to just over 7,500 BTC through four transactions on October 31. At a bitcoin price of around $77,600 on Tuesday afternoon, according to CoinGecko, that is roughly $580 million. Binance has pledged to refill the fund to around $1 billion without giving a date. The exchange token BNB traded at around $700 at the same time, 0.4 percent below the previous day.

As consequences, the report lists closed entry points, rebuilt or replaced systems, stricter device controls and expanded, AI-assisted detection of unusual behavior. Binance is also commissioning an independent cybersecurity audit.

How to protect yourself from fake recruiters and malware in test assignments

What happened: In September 2026, attackers contacted a Binance engineer through a job platform, held video calls under false identities and got him to open an infected coding assignment on his work computer. On October 29, more than $6.3 billion drained out through this route (Binance incident report, as of November 3, 2026).

Are you affected? As a Binance customer you do not have to bear any loss, according to the exchange; your balance is being replaced and withdrawals are returning in phases. You can be hit by the same scheme if you work in the crypto industry, write code or apply for jobs with a crypto connection. A warning sign is an unusually fast, well-paid offer that leads to a task requiring you to download and run unfamiliar files.

1. Verify identity separately: Call the company on a number or address you looked up yourself before accepting an invitation to a second interview, and never rely on contact details from the recruiter's message.
2. Test assignments only in isolation: Open coding tasks from hiring processes only in a virtual machine with no access to your wallets, passwords and company accounts, as the FBI recommends.
3. No seed phrase on connected devices: Never store recovery phrases or private keys on a computer, phone or in the cloud; malware searches exactly these places first.
4. Software only from the original source: Install developer tools, AI assistants and browser extensions only via the link on the vendor's site, and check names and publishers carefully in package managers.
5. Larger amounts offline: Keep what you do not trade on a hardware wallet, and use a separate wallet with a small balance for tests, DeFi and airdrops.

Our guide how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison lines up the right devices.

Social engineering against retail investors: the scheme reaches far beyond exchanges

Social engineering refers to attacks that target people rather than technology: perpetrators gain trust and get their victim to carry out the decisive action themselves. At Binance, that was downloading a test assignment. For retail investors, it is usually approving a transaction, entering the seed phrase or installing a supposedly useful app.

Fake job offers are a recurring route. Besides hiring tests, the FBI also lists supposed investment offers and approaches from well-known industry figures that rely on stolen photos and cloned company websites. Anyone who manages crypto on the same computer they use to open unfamiliar files carries, on a small scale, the same risk Binance faced on a large one.

The case also shows that good key management alone is not enough. Binance used MPC and replaced the device after the first incident in June. That did not stop the attack, because the perpetrators stole permissions rather than keys and kept their knowledge of the team. For investors, this means keeping the devices you work and browse on separate from the device you sign with.

Binance hack: one job interview opened the way to $6.3 billion

The incident report turns the record hack into a case of personnel security. Three steps help you apply its lesson to your own holdings:

1. A separate wallet for testing: Set up a dedicated software wallet with a small balance for DeFi, airdrops and new applications. You will find suitable apps in the software wallet comparison.
2. Keep long-term holdings offline: What you do not trade belongs on a device that never runs third-party code. Models and prices are in the hardware wallet comparison.
3. Choose exchanges by license: For the balance you leave on a trading platform, what counts is EU authorization, proof of reserves and clear compensation rules. Providers with a MiCA license are listed in the comparison of regulated crypto exchanges.

(As of November 3, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)