Hackers stole $6.3 billion from Binance via fake job interview

Hackers stole $6.3 billion from cryptocurrency exchange Binance on October 29, 2026, after a months-long operation that began with a fake job interview and malware-laced file, according to a preliminary company report. The exchange stated it will cover all financial losses from its own reserves. The attack started in June 2026 when an engineer downloaded a fake AI programming tool, compromising his credentials. In September, hackers posing as recruiters for a nonexistent company conducted video interviews with another engineer, convincing him to install a malicious test assignment on his work computer. By October 21, they had used the infected machine to access devices of two wallet-operating employees. On the attack day, hackers used stolen credentials to deploy a container and reach Binance's internal transaction signing service, moving funds from hot wallets within minutes. They exploited an Ethereum mechanism to continue transfers even after withdrawals were paused. Binance has since rebuilt its wallet system, replaced compromised devices, and strengthened internal security, while citing FBI information linking the attack to North Korea.