Binance hackers used fake interviews and social media profiles in $6.3 billion heist

Unlock Editor’s Digest for free

Roula Khalaf, editor-in-chief of the FT, selects her favorite stories in this weekly newsletter.

Binance said attackers who stole $6.3 billion from the crypto exchange last week staged fake job interviews to trick a software engineer at the company into installing malicious code, findings from an investigation into the heist showed.

“This was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including… fake recruitment interviews, malware downloads” and other methods, Binance said Tuesday.

The FBI on Saturday accused TraderTraitor, a hacking group linked to North Korea, of stealing $6.3 billion from Binance in the largest heist on record. The attack came as advances in artificial intelligence have led to a rise in such crypto hacks, revealing vulnerabilities in blockchain technology.

But Binance’s findings highlight the significant role of human error in giving hackers access to exchange systems.

Binance said that in June one of its engineers downloaded falsified software. This was detected by Binance’s systems and the engineer’s device was replaced, but not before “the role of the engineer and his colleagues on our wallet infrastructure team (were) exposed to the hacker,” the company said.

In September, a second Binance engineer was contacted via a job search platform by someone claiming to be a project director at what turned out to be a fake company. The engineer participated in what he thought was a job interview, during which the interviewer shared his profile on social media, “including personal photos and videos posted on the platform, in order to build trust,” Binance said. He described the episode as “more advanced and deceptive than social engineering approaches seen before.”

During a second interview with a person claiming to be the CEO of the fake company, which took place via a social chat app, the interviewer asked the engineer to upload an interview assignment containing malicious code. This download went undetected and allowed attackers to use Binance’s internal AI tools to take control of certain exchange systems.

“The malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate developer tool component with a malicious version to execute commands and establish communication with an external server controlled by an attacker,” Binance said.

Once the malware was in place, the attackers used the engineer’s compromised laptop and a Binance AI tool to control the laptops of the first and a third engineer. The first engineer had the ability to release code, which hackers used to their advantage.

On October 29, the day of the hack, the attackers logged into the third engineer’s laptop and “triggered a malicious script to launch the attack.”

Binance said it has since rebuilt its wallet systems and AI tools, and is working with external cybersecurity experts to strengthen its security systems. It said it had set aside enough funds to cover user losses and had restored its customers’ ability to withdraw funds.

It also said it would keep certain details of its security measures confidential, “to prevent malicious actors from using them to plan future attacks.”

Yi He, co-CEO of Binance, said that so far in 2026, the company has detected and neutralized 57 suspected North Korean cyber threats.

“We intercepted a lot of them, but the cost of not stopping a single one was very high – and it should never have happened,” she said.