{"id":108205,"date":"2026-11-04T13:20:22","date_gmt":"2026-11-04T09:20:22","guid":{"rendered":"https:\/\/techxmedia.com\/en\/?p=108205"},"modified":"2026-11-04T13:22:12","modified_gmt":"2026-11-04T09:22:12","slug":"binance-hack-how-fake-job-interviews-led-to-6-3b-theft","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/binance-hack-how-fake-job-interviews-led-to-6-3b-theft\/","title":{"rendered":"Binance Hack: How Fake Job Interviews Led to $6.3B Theft"},"content":{"rendered":"\n

The Binance hack has become one of the most closely watched cyber incidents in the crypto industry. According to Reuters<\/a>, hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers. They then used a third engineer\u2019s computer to drain $6.3 billion worth of crypto. The theft happened last week and is described as a record heist.<\/p>\n\n\n\n

On Tuesday, Binance published its first report on how it happened. It describes a multi-stage attack that began in June.<\/p>\n\n\n\n

A Tampered Tool Opens the Door in June<\/strong><\/p>\n\n\n\n

The story starts in June. An employee on the wallet developer team downloaded a tool from the internet. Hackers had tampered with it.<\/p>\n\n\n\n

Binance says it detected the problem afterwards. It replaced the device and changed credentials. But the employee\u2019s role, and those of others on the wallet team, were still exposed.<\/p>\n\n\n\n

A person familiar with the incident told Reuters that the malicious version of the tool had been placed in an advertisement. That helped it appear higher in a search engine than the real version.<\/p>\n\n\n\n

A Fake Interview in September<\/strong><\/p>\n\n\n\n

The next step came in September. A second software engineer was looking for a new job. After interviewing for what they thought was a legitimate role, the engineer downloaded a \u201cmalicious code repository\u201d onto their computer.<\/p>\n\n\n\n

The interview included a virtual meeting with the CEO of a fictitious company, according to Binance\u2019s report.<\/p>\n\n\n\n

Fake job interviews are a well-known hacking technique. Michael Barnhart, a researcher at cybersecurity firm DTEX, said experts and government officials have warned about them for years. North Korean and other hackers have used them to target employees at companies of interest.<\/p>\n\n\n\n

Control of Wallet Systems<\/strong><\/p>\n\n\n\n

On October 20, the attacker used the compromised computer and an internal AI tool. This gave the attacker control of the wallet developer\u2019s system. It also gave control of a second wallet developer\u2019s system.<\/p>\n\n\n\n

Nine days later, the attacker used the second developer\u2019s computer. The attacker also had stolen credentials from the first wallet developer. From there, the attacker triggered a malicious script to launch the attack.<\/p>\n\n\n\n

Only a limited number of engineers at the company have direct access to wallets, the person familiar with the hack said. Wallets store or trade crypto.<\/p>\n\n\n\n

Crypto Removed in Minutes<\/strong><\/p>\n\n\n\n

The attack unfolded quickly on October 29. It removed 233.46 million XRP from five Binance hot wallets. Hot wallets are connected to the internet. The funds went to an attacker-controlled address in just four minutes.<\/p>\n\n\n\n

Attackers then withdrew other cryptocurrencies, including bitcoin, the exchange said.<\/p>\n\n\n\n

Binance received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised permissions. This resulted in about $2.85 billion of frozen assets.<\/p>\n\n\n\n

However, suspending withdrawals alone could not stop all unauthorised asset movements.<\/p>\n\n\n\n

A Response Slowed by New Procedures<\/strong><\/p>\n\n\n\n

Attackers used 50 signing transactions to manipulate the account. Binance said it had to build new procedures to revoke authorisations. This slowed its response.<\/p>\n\n\n\n

The final unauthorised transfer took place at 2356 GMT. That was nearly four hours after the attack began.<\/p>\n\n\n\n

Binance detected the attack late on Thursday. Even as it worked to lock down its system and freeze withdrawals, the hackers kept taking crypto.<\/p>\n\n\n\n

Attribution and Customer Repayment<\/strong><\/p>\n\n\n\n

The FBI has blamed a North Korean hacking group for the theft. North Korea has rejected the claim.<\/p>\n\n\n\n

Binance says it is repaying all customers whose funds were stolen.<\/p>\n\n\n\n

The Binance hack has raised questions about how attackers breached the world\u2019s largest crypto exchange. It follows years of North Korea-linked attacks that have grown in ambition and frequency. It has also renewed concerns about the vulnerability of digital assets to cybercrime.<\/p>\n\n\n\n

Binance said it detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. Barnhart said this shows Binance is \u201cjust getting barraged.\u201d<\/p>\n\n\n\n

Binance\u2019s Next Steps<\/strong><\/p>\n\n\n\n

In its report, Binance apologised. It said the incident \u201cshould not have happened.\u201d It also apologised for the concern, disruption and uncertainty caused to users, partners and the wider industry.<\/p>\n\n\n\n

As a result of the attack, Binance says it is increasing investment in AI-enabled detection. It is also working on a security research fund and targeted initiatives with AI companies.<\/p>\n\n\n\n

Final Takeaway<\/strong><\/p>\n\n\n\n

The Binance hack shows how a single download, a search ad and a fake interview can open the door to a record theft. Binance has laid out the timeline from June to October 29. The details show how patient the attackers were and how quickly the final theft unfolded.<\/p>\n","protected":false},"excerpt":{"rendered":"

The Binance hack has become one of the most closely […]<\/p>\n","protected":false},"author":67,"featured_media":108207,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[9912],"contributor":[9732],"class_list":["post-108205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","tag-binance","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2026\/11\/Binance-reveals.jpg","author_info":{"display_name":"Muhsin","author_link":"https:\/\/techxmedia.com\/en\/author\/muhsin\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t