Binance robbery started with fake job interview

Binance, the world's largest cryptocurrency exchange, published the incident report regarding the attack that occurred on October 29, in which approximately $6.34 billion in assets were stolen. According to the report, attackers accessed the system through a fake job interview and an artificial intelligence tool used within the company.

The US Federal Bureau of Investigation (FBI) attributed the attack to North Korean hackers. Blockchain analysis companies TRM Labs and Chainalysis also came to the same conclusion. North Korea denied the accusations and described the FBI's statement as "political provocation".

Month-long attack that started with a fake job interview

According to Binance, the attack does not consist of a single mistake, but a campaign spanning months. The first attempt was made in June: An engineer working on the wallet infrastructure downloaded a modified Homebrew installer while trying to install an AI-powered coding tool. The security team noticed this and replaced the device, but the attackers had obtained information about the people in the team.

In September, another engineer was contacted by a fake recruiter on a job search platform. After two meetings, the engineer was asked to download a coding assignment. Malware in the assignment infected the work computer and managed to bypass Binance's security software.

How was the artificial intelligence tool used?

On October 20, attackers used this computer and an in-house artificial intelligence tool to access the devices of two more engineers. They found authorization to distribute software to the wallet infrastructure on one of these devices. On October 29, with this authority, they accessed wallet signing transactions and made unauthorized transfers. Among the stolen items are 18,270 Bitcoins, approximately 233 million XRP and 970 thousand Solana.

Are users affected?

Binance announced that it would cover the cost of the attack itself. According to the company, approximately $2.85 billion in stolen assets were frozen or captured; 98 percent of affected assets have been replaced. Withdrawals, which were suspended after the attack, are being reopened in stages as of November 3.

“This wasn't a single bug or a single leak, it was a months-long campaign,” said Binance co-CEO Richard Teng. The company said it had reinstalled affected systems, expanded its AI-powered security monitoring and launched an independent cybersecurity review. Binance also stated that it detected and blocked 57 more attacks suspected to be linked to North Korea in 2026.

The incident serves as a warning against fake job offers targeting software developers. Not running coding assignments from a company you do not know on your work computer is one of the simplest precautions that can be taken against such attacks.