Cryptocurrency exchange Binance has revealed details of a sophisticated $6.3 billion crypto heist, one of the largest in history, which originated from a cunning fake job interview scam. The elaborate social engineering attack tricked a Binance engineer into compromising internal systems, ultimately leading to the massive theft.
How a Fake Job Offer Led to a Massive Breach
The intricate scheme began in September when hackers, posing as recruiters for a fictional company, approached a Binance engineer on a job-hunting platform. The engineer, targeted due to their access to Binance's internal systems, was initially interviewed by someone claiming to be an HR representative.
To build trust, the fake HR representative shared a social media account with personal photos and videos, a tactic Binance noted as more advanced than typical social engineering approaches. For a subsequent interview, the engineer was directed to a separate messaging application to speak with an individual masquerading as the company's CEO.
During this stage, the fake CEO manipulated the engineer into downloading an 'assignment' onto their Binance work laptop. Unbeknownst to the employee, this file contained malicious code, creating a critical vulnerability that allowed attackers to infiltrate the company's network.
From Compromised Laptop to Billions Stolen
Binance disclosed that while they had successfully blocked several initial security test attempts by the hackers in June, the compromised laptop proved to be the gateway. Attackers leveraged this access to infiltrate other employees’ systems, eventually gaining authorization for wallet transactions. They then exploited an internal AI tool to execute unauthorized transfers.
The theft itself was launched on October 29. According to TRM Labs, approximately $6.36 billion was moved out of Binance wallets across ten different blockchains, with the bulk of the transactions occurring within a mere 20 minutes. Binance has since identified and frozen roughly $3 billion of the affected assets that passed through hacker-linked wallets.
North Korea Link and Binance's Pledge
The FBI has linked the attack to North Korea’s “TraderTraitor” unit, a group previously implicated in the 2025 Bybit hack. However, North Korea has vehemently denied these allegations, calling the claim a “grave political provocation.”
Despite the immense scale of the breach, Binance has assured its users that they will not incur any losses. The exchange has committed to covering all stolen assets using its Secure Asset Fund for Users (SAFU), an emergency insurance fund established to protect users in such events.