Binance says attackers used a fake job interview to steal about $6.3 billion in crypto

Binance has described a multi-stage intrusion that started with a fake recruitment process and ended with crypto worth about $6.3 billion being siphoned from investor wallets on October 29. For PSPs and exchanges, the useful detail is not the headline number alone, but the access path: social engineering, a compromised employee laptop, and gradual access to internal tools.

1. According to Binance’s post on X, the attackers approached “software engineer B” in September through a job-search platform, posing as the director of a project. The engineer’s profile on the platform listed prior Binance experience, which appears to have made the pitch more credible inside the normal hiring flow.
2. The first interview stage was conducted with someone from HR, and the second stage was held with a person pretending to be the CEO of a fictional company. Binance said the attacker shared links to his social media during the first round to build trust, then moved the conversation to a “popular messenger” for the second round.
3. Near the end of that call, engineer B was told to download an “assignment” onto a work laptop. Binance says that file contained a digital storage device with malicious code, which was part of the wider chain used to reach internal systems.
4. Binance said the attack was not a single event but a multi-step operation that played out over several months, with attackers gradually gaining access to internal company tools before the breach on October 29. The exchange said cryptoassets worth about $6.3 billion were taken from investor wallets.
5. Binance said about $2.85 billion in assets were intercepted or frozen after the incident. The FBI had earlier attributed the breach to TraderTraitor, a North Korea-linked group, and Binance has said the compromise stemmed from the laptop of one of its DevOps engineers.