Binance says fake job interviews helped attackers steal $6.340 billion in a multi-stage hack

Binance says the recent cyberattack that the United States has attributed to North Korean hackers started with fake job interviews aimed at an employee. The point for PSPs and crypto operators is simple: this was not a single breach, but a multi-step intrusion that moved through social engineering, compromised AI tooling, and transaction approval controls.

1. In a preliminary report posted on X, Binance said the attackers used social engineering, artificial intelligence tools, and advanced transaction authorization mechanisms to steal assets. The company stressed that this was "not a single isolated breach" or a simple phishing incident, but a "sophisticated" operation carried out in several stages.
2. According to Binance’s reconstruction, in September an engineer received a fake job offer and went through two interviews. After that, the engineer downloaded a supposed technical exercise to a work computer, and the file contained malicious code.
3. Binance said the attackers then used an internal AI tool to compromise other devices and obtain credentials that gave them access to the transaction authorization system. On 29 October, they carried out unauthorized transfers of several cryptocurrencies, including bitcoin, XRP, and assets on the Solana and Ethereum networks.
4. The company said suspending withdrawals was not enough to stop the theft immediately because malicious authorizations allowed funds to move outside its "usual infrastructure." Binance said it has restored 98% of the affected assets and reserved sufficient funds to cover the losses, while about $2.850 billion remains frozen or has been intercepted.
5. Binance also said it will undergo an independent review of its security systems and increase investment in AI-based detection tools. The FBI attributed the attack to the North Korean group TraderTraitor on Saturday, while Pyongyang this week rejected the allegation and called it an "absurd" and "grave political provocation" from the FBI.

Binance added that its security team detected and prevented 57 cyberthreat cases throughout 2026, which is the kind of number that matters less as a badge of honor than as a reminder that high-risk platforms are dealing with persistent, repeated attempts rather than one-off incidents.