Binance Hackers Used Fake Job Interview and Malicious Ad Before $6.3B Crypto Theft

Binance hackers spent months preparing a $6.3 billion (approximately £4.67 billion) cryptocurrency theft by infiltrating staff computers through a fake job interview and a booby-trapped software download, the exchange has revealed.

The methods were disclosed on Tuesday, 3 November, after Binance investigated how attackers compromised three software engineers' devices ahead of the 29 October 2026 raid on its wallets.

According to the exchange, the breach did not begin with a single suspicious email or sudden break-in. Binance traces the intrusion back to June, when an employee downloaded an altered software tool that had been tampered with.

A second deception followed in September, when a bogus recruitment process helped the attackers move closer to systems controlling the exchange's cryptocurrency wallets.

By the time Binance detected unusually large transfers, the attackers had already begun moving assets. The exchange says the last unauthorised transfer occurred nearly four hours after the first, despite efforts to halt withdrawals and freeze affected holdings.

Malicious Ad Turned Routine Download Into Backdoor

The first known opening involved an engineer on Binance's wallet development team. In June, the employee downloaded a tool from the internet without knowing that attackers had tampered with it, according to the exchange's report.

A person familiar with the incident told Reuters that the malicious version had appeared in an online advertisement. Its placement made the compromised download appear above the genuine version in search results, exploiting an ordinary software search.

Binance eventually detected the compromise, replaced the employee's computer and changed the affected credentials. Yet the damage was not entirely contained.

The attackers had gained information about that engineer's work and the colleagues involved in managing digital wallets.

Those details mattered because access to the exchange's wallets was limited to a relatively small group of engineers. The initial compromise helped attackers identify people whose devices and credentials would be valuable in a later assault.

The next approach was more personal.

Fake CEO, Fake Company: Job Hunt Turned Cyber Trap

In September, another software engineer was looking for work when an apparently legitimate opportunity surfaced. The employee participated in interviews for a company that did not exist, including a virtual meeting with someone presented as its chief executive.

As part of that recruitment process, the engineer downloaded what Binance described as a 'malicious code repository.' Instead of serving as an ordinary coding exercise, the files compromised the computer and became another route into the exchange's internal environment.

Michael Barnhart, a researcher at cybersecurity company DTEX, told Reuters that bogus job interviews were a recognised tactic. He described the repeated attempts against Binance as evidence that the company was 'just getting barraged.'

Hackers Breached Wallet Systems Before October Raid

On 20 October, the attackers used the computer compromised through the fake interview, together with an internal artificial intelligence tool. Binance said this allowed them to take control of two wallet developers' systems.

Nine days later, the operation moved from access to theft. Using one developer's computer and credentials taken from another, the attackers triggered a malicious script directed at the exchange's cryptocurrency holdings.

The first withdrawals were extraordinarily fast. Binance said attackers transferred 233.46 million XRP tokens from five internet-connected wallets to an address they controlled within four minutes. They then moved other cryptocurrencies, including bitcoin.

An internal alert drew attention to the large transfers. Security staff began investigating, suspended withdrawals, froze tokens and attempted to remove unauthorised permissions. Those measures did not immediately prevent all further movements.

Binance said attackers had used 50 signing transactions to manipulate the affected account. Its team had to develop new procedures to revoke permissions, complicating the response while the theft was unfolding.

The exchange reported freezing approximately $2.85 billion (approximately £2.11 billion) in assets. Nevertheless, it said the final unauthorised transfer took place at 23.56 GMT on 29 October, almost four hours after the attack began.

Attribution Row as Binance Pledges Repayment

The FBI has attributed the attack to a North Korean hacking group. North Korea has rejected that allegation, and the attribution should not be treated as an undisputed finding.

Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats during 2026. The figure indicates the pressure facing its security teams, although it does not establish who carried out this particular theft.

Binance apologised for the incident. 'This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.'

Binance has pledged to reimburse customers whose funds were stolen. It also said it would increase investment in AI-enabled threat detection and pursue a security research fund alongside initiatives involving leading AI companies.

The exchange is also examining how unauthorised permissions survived its withdrawal suspension. Those authorisations, Binance said, required additional steps to revoke while attackers continued moving cryptocurrency.