How a Fake Job Interview Led to the $6.34 Billion Binance Hack
Direct answer
Binance has now explained, in its own initial incident report, how hackers got inside its systems before stealing about $6.34 billion in crypto on October 29, 2026. The report describes a slow, multi-step attack that started months earlier: a tampered software download in June, a fake job interview in September, and the use of a compromised internal AI tool on October 20 to take control of more wallet team computers.
What happened
The story began in June 2026, according to Binance. An engineer on its wallet team downloaded a version of a common software installation tool that hackers had tampered with. Binance said it later found that download, replaced the device, and changed passwords, but the incident still exposed the roles of that engineer and other wallet team members.
In September, the attackers approached a second engineer through a job hunting platform. The engineer was put through two rounds of interviews for a company that did not exist, first with a person posing as a human resources representative, then with a person claiming to be the chief executive. At the end of the process, the engineer was told to download a coding assignment onto a work computer. That assignment contained malicious code that replaced part of a genuine developer tool, letting the attackers run commands and contact an outside server.
On October 20, the attackers used that compromised computer, together with an internal Binance AI tool, to take control of the systems of two wallet developers. Nine days later, on October 29, they used stolen credentials and a malicious script to launch the theft.
The theft itself was fast. Binance said 233.46 million XRP tokens were moved out of five internet connected hot wallets in just four minutes, followed by other crypto including bitcoin. The attackers used 50 signing transactions to move funds, and Binance said it had to build new procedures to cancel permissions, which slowed its response. The final unauthorised transfer was at 2356 GMT on October 29, nearly four hours after the attack began.
Binance said about $2.85 billion of the stolen assets had been frozen or intercepted. It also said it is repaying customers whose funds were stolen, and that it had detected and prevented 57 suspected North Korea linked cyber threats in 2026. The US Federal Bureau of Investigation has blamed a North Korean hacking group for the attack, a claim North Korea has rejected. That attribution is therefore reported here as the FBI assessment, not as a confirmed finding by Binance itself. Cybernews reported Binance’s account on November 4, 2026, and The Hindu BusinessLine also reported the same core details from Binance’s investigation.
For the earlier account of the hack itself, see our post on the Binance hack of $6.3 billion.
Why it matters for beginners
This story matters even if you never use Binance, because it shows that a large hack does not always start with a dramatic break in. It can start with something ordinary, such as a job interview or a software download that looks normal.
A hot wallet is a wallet connected to the internet, so it can move funds quickly. That speed is useful for an exchange, but it also means that once attackers gain the right access, they can move a lot in minutes. A signing transaction is a step that authorises a transfer, so control over signing is one of the most sensitive parts of any crypto platform.
The case is also a warning about trust. When a platform holds customer assets, its internal controls matter as much as its public promises. Binance said user funds are safe and that it will cover the losses, but confidence still depends on the full investigation, on how much is recovered, and on what security changes follow.
What to watch next
First, watch for Binance’s fuller technical post-mortem, which it said would follow once the investigation is complete. Second, watch whether the frozen share rises above about $2.85 billion, or whether more funds move beyond recovery. Third, watch what Binance changes in practice, including its promised extra investment in AI enabled detection and a security research fund. Fourth, watch whether other exchanges or authorities confirm the FBI attribution or publish their own findings about the same methods, since fake job interviews are a known tactic used against staff at other firms too.
FAQ
Was this a new hack, or the same one reported on October 30?
It is the same October 29 theft, now explained in more detail. The new part is Binance’s own account of how the attackers got in, starting in June and September, rather than the size of the loss itself.
How much was stolen, and how much was frozen?
Binance put the total at about $6.34 billion. About $2.85 billion had been frozen or intercepted in its latest update, subject to reconciliation and price movements.
Did Binance say customers lost money?
Binance said it is repaying customers whose funds were stolen, and that user funds remain safe. Follow official Binance updates for the latest status, since the investigation is still open.
Why did a fake interview work?
The interview looked real: a live video round, a second round with a supposed chief executive, and a normal sounding coding assignment. The assignment was the trap, because running it installed malicious code on a work computer.
What is a hot wallet?
It is a crypto wallet connected to the internet. Hot wallets allow fast transfers, which is why exchanges use them, but they also need very tight access controls.
