Binance said hackers spent months preparing for the theft of $6.3 billion from the cryptocurrency exchange, using a fake job interview to compromise an employee’s work computer before accessing systems involved in signing transactions.
According to the company’s report, a person posing as a project director contacted a Binance software engineer through a job-hunting platform in September. After two interviews, including a video call with someone claiming to work in human resources, the engineer was asked to download an assignment to his work computer. Binance said the file contained malicious code that its security tools did not detect.
On Oct. 20, the attackers used the compromised computer and an internal Binance AI tool to take control of the work computers of two engineers on the wallet team. One had permission to deploy software, Binance said. Nine days later, the hackers used that access to reach a service that signs transactions and drained the exchange’s hot wallets over nearly four hours.
“This should not have happened,” Binance said in its report.
The company described the theft as the largest in crypto history. The previous record was set in February 2025, when hackers stole about $1.5 billion in digital tokens from Dubai-based exchange Bybit.
The FBI said on Saturday that the Binance attack was carried out by TraderTraitor, a North Korean hacking unit. North Korea has denied the accusation. Binance said it had identified and blocked 57 other suspected North Korean hacking attempts this year.
Sources: The New York Times Technology.