Binance hackers used fake job interview in $6.3 bil. attack

Hackers stole $6.3 billion in cryptocurrency from Binance on Thursday after compromising employees’ computers through a bogus job interview and tampered software, the exchange said. The attack began with an employee downloading a compromised tool in June and escalated through further breaches in September and October. Binance said it froze about $2.85 billion in assets and would repay affected customers. The FBI blamed a North Korean hacking group, which North Korea rejected.

The attack began in June when a wallet-team employee downloaded a tampered internet tool; Binance said it later replaced the device and changed credentials.

In September, a second software engineer downloaded a malicious code repository after interviewing for a fictitious job that included a virtual meeting with the company’s purported CEO.

On October 20, the attacker used a compromised computer and an internal AI tool to gain control of two wallet developers’ systems.

On October 29, attackers moved 233.46 million XRP from five Binance hot wallets to an attacker-controlled address in four minutes.

Binance said it detected and prevented 57 suspected North Korea-linked cyberthreats in 2026 and plans to increase investment in AI-enabled detection and establish a security research fund.

Published Nov 4, 2026 3:13 am KST

Updated Nov 4, 2026 7:59 am KST

PARIS/DETROIT — Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third's computer to drain $6.3 billion worth of crypto in last week's record heist, the exchange said on Tuesday.

In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking endeavour that began in June and set off a series of security breaches culminating in the theft on Thursday.

Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Thursday, the hackers were still making off with crypto from the exchange nearly four hours after the first theft, Binance said.

The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers whose funds were stolen.

The attack has raised questions about how hackers breached the world's largest crypto exchange after years of North Korea-linked attacks, which have grown in ambition and frequency, and renewed questions about the vulnerability of digital assets to cybercrime.

Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest, said Michael Barnhart, a researcher with cybersecurity firm DTEX.

Fake job interviews are a well-known hacking technique.

Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. That shows Binance is “just getting barraged,” Barnhart said.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry," Binance said in its report.

Binance said the attack began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with. The exchange said it detected this afterwards, replaced the device and changed credentials, but the employee's role and those of others on the wallet team were exposed.

A person familiar with the incident said the tool's malicious version had been placed in an advertisement, which meant it appeared higher in a search engine than the real version.

Then in September, a second software engineer seeking a new job downloaded a "malicious code repository" onto the person's computer after interviewing for what they thought was a legitimate role, including meeting virtually with the CEO of a fictitious company, Binance's report said.

On October 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer's system and that of a second wallet developer.

Nine days later, the attacker used the second wallet developer's computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.

A limited number of engineers at the company have direct access to wallets — which store or trade crypto — the person familiar with the hack said.

Crypto removed in minutes

The attack unfolded quickly on October 29, removing 233.46 million XRP — a cryptocurrency — from five Binance hot, or internet-connected, wallets to an attacker-controlled address in just four minutes, before attackers withdrew other cryptocurrencies including bitcoin, the exchange said in its report.

Binance said it received an internal alert about large transfers and began investigating. It moved to suspend withdrawals, freeze affected tokens and remove unauthorised permissions, resulting in about $2.85 billion of frozen assets, but suspending withdrawals alone could not stop all unauthorised asset movements.

Attackers used 50 signing transactions to manipulate the account, while Binance said it was forced to build new procedures to revoke authorisations, slowing its response.

The final unauthorised transfer was at 2356 GMT, Binance said, nearly four hours after the attack began.

Binance said as a result of the hack, it was increasing investment in AI-enabled detection and working on establishing a security research fund and targeted initiatives with leading AI companies.

币安交易所周四表示，黑客通过虚假招聘面试和篡改软件入侵员工电脑，窃取了价值63亿美元的加密货币。攻击始于6月份一名员工下载了被篡改的工具，并在9月和10月通过进一步的入侵升级。币安表示，已冻结约28.5亿美元的资产，并将赔偿受影响的客户。美国联邦调查局（FBI）将矛头指向朝鲜黑客组织，但朝鲜否认了这一说法。

攻击始于 6 月，当时一名钱包团队员工下载了一个被篡改的互联网工具；币安表示，他们后来更换了该设备并更改了凭证。

9 月，第二名软件工程师在参加了一场虚构工作的面试后下载了一个恶意代码库，面试内容包括与该公司所谓的 CEO 进行虚拟会议。

10 月 20 日，攻击者利用一台被入侵的计算机和内部人工智能工具控制了两个钱包开发商的系统。

10 月 29 日，攻击者在四分钟内将 2.3346 亿 XRP 从五个币安热钱包转移到攻击者控制的地址。

币安表示，2026年该公司检测并阻止了57起疑似与朝鲜有关的网络威胁，并计划增加对人工智能检测的投资，同时设立安全研究基金。

发布于2026年11月4日凌晨3:13（韩国标准时间）

更新于2026年11月4日 上午7:59（韩国标准时间）

巴黎/底特律——币安交易所周二表示，黑客利用虚假的求职面试和隐藏在广告中的软件入侵了两名币安软件工程师的电脑，然后又利用第三名工程师的电脑盗取了价值 63 亿美元的加密货币，造成了上周创纪录的盗窃案。

币安在其关于黑客如何实施可能是史上最大金融盗窃案的初步报告中，详细介绍了从 6 月开始的多阶段黑客行动，该行动引发了一系列安全漏洞，最终导致周四发生的盗窃案。

币安表示，尽管币安在周四晚些时候发现攻击后紧急封锁了系统并冻结了提现，但黑客在首次盗窃发生近四个小时后仍在从交易所窃取加密货币。

美国联邦调查局将此次事件归咎于一个朝鲜黑客组织，但朝鲜否认了这一说法。币安公司表示，正在向所有资金被盗的客户进行赔偿。

此次攻击引发了人们对黑客如何攻破全球最大加密货币交易所的疑问。多年来，与朝鲜有关的网络攻击规模不断扩大，频率也越来越高。此次攻击也再次引发了人们对数字资产易受网络犯罪攻击的担忧。

网络安全公司 DTEX 的研究员迈克尔·巴恩哈特表示，网络安全专家和政府官员多年来一直警告说，朝鲜和其他国家的黑客利用虚假的求职面试来攻击目标公司的员工。

虚假求职面试是一种众所周知的黑客技术。

币安表示，2026年该公司检测并阻止了57起疑似与朝鲜有关的网络威胁。巴恩哈特说，这表明币安“正遭受猛烈攻击”。

币安在其报告中表示：“这本不应该发生，我们对此给用户、合作伙伴和整个行业带来的担忧、干扰和不确定性深表歉意。”

币安表示，此次攻击始于6月，当时其钱包开发团队的一名员工从网上下载了一个已被黑客篡改的工具。币安称，事后他们发现了这一情况，更换了设备并更改了凭证，但该员工以及钱包团队其他成员的身份信息仍然暴露。

一位知情人士表示，该工具的恶意版本被放置在广告中，这意味着它在搜索引擎中的排名比真实版本更高。

随后在 9 月份，币安的报告称，第二名软件工程师在面试后下载了一个“恶意代码库”，而他当时认为自己应聘的是一个合法的职位，面试过程还包括与一家虚构公司的 CEO 进行线上会面。

10 月 20 日，攻击者利用被入侵的计算机和内部 AI 工具控制了钱包开发者的系统以及另一个钱包开发者的系统。

九天后，攻击者利用从第一个钱包开发者那里窃取的凭证，在第二个钱包开发者的电脑上触发了一个恶意脚本，发动了攻击。

一位知情人士透露，该公司只有少数工程师可以直接访问钱包（用于存储或交易加密货币）。

几分钟内即可移除加密货币

币安交易所在其报告中称，此次攻击于 10 月 29 日迅速展开，仅用了四分钟时间，就将 2.3346 亿枚 XRP（一种加密货币）从五个币安热钱包（或称联网钱包）转移到了一个攻击者控制的地址，之后攻击者又提取了包括比特币在内的其他加密货币。

币安表示，他们收到内部警报，称存在大额资金转移，并随即展开调查。币安采取措施暂停提现、冻结受影响的代币并移除未经授权的权限，导致约28.5亿美元的资产被冻结。但仅靠暂停提现无法阻止所有未经授权的资产转移。

攻击者利用 50 笔签名交易操纵了该账户，而币安表示，它被迫建立新的程序来撤销授权，这减慢了其响应速度。

币安表示，最后一次未经授权的转账发生在格林尼治标准时间 23:56，距离攻击开始已近四个小时。

币安表示，由于此次黑客攻击，公司正在加大对人工智能检测技术的投资，并致力于建立安全研究基金，以及与领先的人工智能公司开展有针对性的合作项目。