Binance disclosed that hackers stole $6.3 billion from its platform through a sophisticated operation involving fake job interviews and compromised internal tools. The exchange, which operates as the world's largest cryptocurrency platform, published an initial report detailing how attackers gained access to company wallets before the October 29 theft.

The breach represents the largest cryptocurrency hack in history. Binance was forced to temporarily halt withdrawals for users worldwide, with service restored on Sunday.

Social Engineering Campaign

Binance traced the operation's start to June, when a wallet infrastructure team engineer downloaded a compromised version of an AI coding tool. The company's security personnel identified the problem, swapped out the affected equipment, and updated all associated login information, though the positions of that worker and his teammates had already been revealed to the attackers.

In September, attackers reached out to a Binance software engineer through a legitimate job-hunting platform, with one individual posing as a Project Director. The engineer's profile on the platform mentioned his employment at Binance.

"The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company," Binance said. The engineer completed a video interview with the fake HR representative, who shared a social media account filled with personal photos and videos to build trust.

Malware Deployment and System Compromise

During the second interview, conducted in a popular social chat app, attackers told the engineer to download what they described as an assignment, which actually contained malicious code that he installed on his work computer. "The repository contained malicious code that executed during the setup process, initiating a series of unauthorized activities," said Binance.

The malware evaded detection through obfuscation techniques. By October 20, attackers had used the compromised computer along with an internal AI tool to seize control of systems belonging to two additional wallet team engineers.

On the day of the heist, "the attacker logged onto Software Engineer C's computer, used the credentials stolen from Wallet DevOps Engineer A, deployed a container, and triggered a malicious script to launch the attack," Binance said. The company reported that attackers moved 233.46 million XRP tokens from five internet-connected hot wallets within four minutes.

Response and Recovery Efforts

Binance said about $2.85 billion of the stolen assets had been frozen or intercepted. The company assured clients it had allocated funds exceeding 100% of what was needed to cover the loss, with 98% of affected token assets replenished as of Saturday.

"We apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in a statement. The company noted it has taken multiple steps following the breach, including working with law enforcement to trace and secure the stolen assets.

Federal law enforcement in the United States, specifically the FBI and Secret Service, are helping Binance track down the cryptocurrency removed from its corporate wallets. The FBI has said North Korean hackers were behind the theft, though the country has denied any involvement.

North Korea Allegations

Many analysts believe the methods used in this incident resemble earlier attacks linked to hackers from North Korea. On Tuesday, Binance wrote in a post on X that the latest information released by the FBI indicates the Democratic People's Republic of Korea is responsible for the incident.

Kim Yo Jong, a top Democratic People's Republic of Korea official and the sister of leader Kim Jong Un, said the accusations were another "sinister attempt" by the US to damage North Korea's public image. Pyongyang has repeatedly rejected responsibility for numerous significant cyber incidents it has faced accusations over in recent years.

Richard Teng, the chief executive of Binance, posted on X Tuesday describing the breach as stemming from an extended operation and characterizing it as among the most advanced attacks the digital asset sector has witnessed.

Security Enhancements

Following the incident, Binance has pledged to strengthen its security measures. The exchange plans to boost spending on artificial intelligence systems designed to identify threats and bring in outside cybersecurity specialists to conduct a thorough examination of what occurred.

Binance also intends to create a fund dedicated to security research and partner with major tech companies on specific projects aimed at improving protection. The company said it detected and prevented 57 suspected North Korea-linked threats in 2026.

Ben Jones, practice lead for cyber security at Coder Trove, told Human Resources Director that the case should change how employers think about recruitment risk. "Binance's incident report reads like a textbook on DPRK recruitment tradecraft," he said.

"The practical fix sits with HR and hiring managers: verify identity continuously, treat unsolicited recruiter contact to your engineers as a security event, and never let a candidate or interviewer run code on a corporate device," Jones said.

Conclusion

The Binance hack demonstrates how social engineering tactics, including fake job interviews, can be used to compromise even the largest cryptocurrency platforms. The company has replenished 98% of affected token assets and frozen or intercepted $2.85 billion of the stolen funds.

Binance is working with US law enforcement agencies including the FBI and Secret Service to trace the remaining stolen assets. The company has committed to boosting spending on AI-powered threat identification systems, bringing in external reviewers to examine the incident, and creating a fund for security research to prevent future incidents.

Frequently Asked Questions

How much did hackers steal from Binance in the October 2026 heist?

Hackers stole $6.3 billion from Binance on October 29, 2026. The theft represents the largest cryptocurrency hack in history. Binance said about $2.85 billion of the stolen assets had been frozen or intercepted.

How did hackers use fake job interviews to breach Binance?

In September, hackers contacted a Binance software engineer through a legitimate job-hunting platform, posing as a Project Director. They arranged fake interviews with individuals claiming to be an HR representative and a CEO. During the second interview, the engineer was instructed to download an assignment containing malicious code.

Who does the FBI blame for the Binance hack?

The FBI has blamed North Korea for the record crypto heist. Binance wrote in a post on X that the latest information released by the FBI indicates the Democratic People's Republic of Korea is responsible for the incident. North Korea has denied any involvement.

What security measures is Binance implementing after the hack?

Binance is increasing investment in AI tools that can detect security threats, engaging third-party cybersecurity experts for a comprehensive review, and establishing a security research fund. The company also plans to collaborate with leading technology firms on targeted security initiatives.

When did Binance restore withdrawals after the hack?

Binance temporarily halted withdrawals for users worldwide following the breach. The restriction lasted until service was reinstated on Sunday. Once operational, users withdrew billions of dollars of assets from the platform.