North Korean hackers used a fake job interview to steal about $6.3 billion from Binance

Summary

Binance says North Korean hackers stole about $6.34 billion in digital assets in an October 29 theft that followed months of preparation. According to Binance, an engineer was contacted in September on a legitimate job-hunting platform by someone posing as a project director at a fictitious company. A fake HR representative held a live video call during the first round, and in the second round the engineer was asked to download an infected code repository as an interview assignment. The intrusions eventually gave the hackers access to the exchange's internal wallet signing systems. Binance also said another engineer installed a tampered Homebrew package in June to set up a popular AI coding tool. Binance detected that installation, replaced the device and rotated all credentials, but the engineer and colleagues had already been exposed. Binance says it has detected and prevented 57 suspected North Korea-linked cyber incidents so far in 2026, and that the heist was not a single isolated breach or a simple phishing incident.

Timeline

1. Channel NewsAsia

   3 Nov 2026, 14:51 UTCSource ↗

   Channel NewsAsia reports that Binance revealed the US$6.34 billion hack was linked to North Korean hackers who used fake job interviews and malicious software.

2. Axios

   3 Nov 2026, 19:49 UTCSource ↗

   Axios reports that Binance said an engineer was contacted in September through a legitimate job-hunting platform, was later asked to download an infected code repository as an interview assignment, and that Binance has detected 57 suspected North Korea-linked incidents so far in 2026.

3. BleepingComputer

   3 Nov 2026, 20:05 UTCSource ↗

   BleepingComputer reports that Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets.

4. NPR

   3 Nov 2026, 21:30 UTCSource ↗

   NPR reports, citing the crypto exchange, that North Korean hackers carried out the biggest cyber heist ever by duping a Binance engineer into thinking he was being recruited for a job.

5. The Register

   3 Nov 2026, 22:04 UTCSource ↗

   The Register reports that Binance said the North Korean fake job interview led to the $6.3 billion heist and that it was not a single isolated breach or a simple phishing incident.

6. Tom's Hardware

   4 Nov 2026, 13:00 UTCSource ↗

   Tom's Hardware reports that Binance revealed North Korean attackers spent months compromising systems and employees with malicious developer software and a fake recruitment process, enabling the October 29 theft.