Binance says hackers used fake job interviews and malware to steal $6.3 billion in record crypto heist

Hackers stole $6.3 billion from Binance using fake job interviews and malware, in the largest cryptocurrency heist on record.

Binance, the world’s largest cryptocurrency exchange, disclosed the breach in an updated statement posted on X on Tuesday. The FBI has blamed North Korea. Binance said it has replenished 98% of affected token assets as of Saturday. Following the hack, the exchange suspended customer withdrawals globally, leaving users unable to move their cryptocurrency off the platform.

How the attack unfolded

The operation began in two stages. In June, one engineer inadvertently downloaded a tampered app containing password-stealing malware after searching for the software in search engine results, exposing the employee’s role and that of others on the wallet infrastructure team. In September, a fake project director contacted a different engineer on a legitimate job-hunting platform, and the perpetrators used what Binance described as more advanced and deceptive methods to build trust, including sharing social media accounts containing personal images. That contact led to a first-round video interview with a sham HR representative, followed by a second-round interview on a chat app with the “chief executive” of a fictitious company. During that second interview, the engineer was tricked into downloading malware disguised as a coding assignment. The malware used obfuscation techniques to evade detection. Binance’s security tools did not detect it.

Binance replaced the first compromised engineer’s laptop. Hackers then used the engineer’s stolen credentials to break into the computer of a third engineer, whose role granted access to systems capable of controlling billions of dollars in crypto. On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of that engineer’s system and a second wallet developer on the same team. On 29 October, the attacker used the second developer’s computer, with stolen credentials from the first engineer, to trigger a malicious script that drained hot wallets.

Response and recovery

“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its update. The company said it has set aside more than 100% of the funds needed to cover the loss. Customer withdrawals were restored on Sunday. Customers withdrew billions of dollars worth of assets after withdrawals reopened. Binance said it is bringing in third-party cybersecurity experts to review the incident, increasing investment in AI tools to detect security threats, and working with law enforcement to trace and freeze affected assets. The US Secret Service has been assisting Binance in tracing the stolen crypto.

Across the industry, other crypto firms moved quickly to contain the damage. Tether, Circle, Ripple, and others froze or restricted access to about $3 billion in stolen assets, and Coinbase blocked transfers to compromised wallets while offering Binance direct assistance. Binance said $2.85 billion of the drained funds had been frozen or intercepted through these and other efforts. CEO Richard Teng told CNBC the company is still in the process of purchasing outstanding, more illiquid assets.

Attribution and denial

The FBI said on Saturday that North Korea was responsible for the hack. Binance posted on X citing the FBI’s finding that the Democratic People’s Republic of Korea is responsible for the incident. Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un, rejected the claim in comments reported by KCNA, the country’s state news agency. She said the FBI is trying to brand the DPRK as a “cybercriminal state” and called the US assertion “absurd rhetoric.” She said it is a grave political provocation that the US misleads international public opinion as if all cybercrimes in different parts of the world are North Korea’s deeds. The TraderTraitor unit, also known as the Lazarus Group, was blamed for the then-record $1.5 billion hack of crypto exchange Bybit in 2025. Binance said it has faced at least 57 suspected attacks from North Korea, reflecting what it called the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. North Korea has long been accused of carrying out massive cryptocurrency thefts to fund its internationally sanctioned nuclear weapons program.

Implications for the industry

Morgan Stanley analyst Felix Stratmann said in a note that repeated breaches could encourage investors to move assets toward independent custody while continuing to trade on centralized exchanges. He said this would preserve the role of centralized exchanges as liquidity and execution venues while benefiting regulated custodians, including banks, as institutional investors place greater emphasis on asset segregation and operational resilience. Owen Lau, senior analyst at ClearStreet, said smaller companies may lack the resources to invest in cybersecurity at the needed level. Some half of all intrusions at US tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using stolen American identities.