Binance says fake job interviews helped hackers steal $6.3bn

Binance, the world’s largest cryptocurrency exchange, says a record theft of about $6.3bn (£4.7bn) was carried out through a months-long operation. The attackers combined fake recruitment, malicious software and a compromised internal AI tool. The company published initial findings on 3 November 2026, and the BBC reports it is believed to be the biggest crypto theft so far. CNBC and The Guardian have also covered the update.

How the intrusion started

Binance’s account begins in June. An engineer on the team that runs its wallet infrastructure installed what he believed was a popular AI coding tool, which he had found through a web search. The download had been altered. The company says it spotted the activity, replaced the engineer’s device and reset his login details as a precaution, but by then his role and those of his colleagues had already come to the attackers’ attention.

In September, a fake project director contacted another engineer through a legitimate job-hunting website. The candidate had a video interview with a bogus HR representative, then a second round on a messaging app with the supposed chief executive of an invented firm. During that stage he was persuaded to run a “coding assignment” that contained hidden malware. Binance says the code used obfuscation, a technique that disguises malicious code so security tools miss it.

The final attack on the wallets

On 20 October, the attackers used the first engineer’s machine and the internal AI tool to take control of his computer and that of a second developer on the same team. On 29 October, they used the second developer’s computer, along with login details taken from the first engineer, to trigger a malicious script. Hot wallets, the online stores that hold crypto ready for transfer, were then emptied.

The figures vary slightly between reports. The BBC uses $6.3bn, while Binance’s update gives $6.34bn drained. Binance said $2.85bn of that total had been frozen or intercepted. CNBC reports that Binance, together with Tether, Circle and Ripple, has helped freeze about $3 billion, although some stolen money is still moving through laundering routes, which are methods of passing funds through many transactions to hide where they came from.

Impact on customers and the response

Binance halted withdrawals for customers worldwide, so users could not move their crypto off the exchange until the service resumed on Sunday. After reopening, customers took out billions of dollars in assets, the BBC reports. The company says it is working with police and other authorities to trace and immobilise affected funds. It has also put aside more than 100% of the sum needed to make up the loss, and by Saturday 98% of the affected tokens had been restored.

Binance co-CEO Richard Teng told CNBC that the attackers “spent months building their way in”, rejecting the idea that a single employee’s laptop was the only weak point. CNBC also describes a sharp but brief drop in confidence across crypto markets. Binance itself described the incident as serious and highly sophisticated, and apologised to users, partners and the wider industry.

Who is behind the attack?

US agencies, including the FBI and the Secret Service, are helping trace the stolen crypto. The FBI has said North Korea was responsible, and the BBC notes that analysts see similarities with earlier breaches blamed on Pyongyang. Binance’s own post on X later pointed to the same conclusion. Teng did not directly blame North Korea, though he acknowledged the FBI’s link to hackers tied to a group known as TraderTraitor, also called the Lazarus Group.

TraderTraitor, also known as the Lazarus Group, was linked to a $1.5bn theft from the Bybit exchange in 2025, which was the largest of its kind at that time. North Korea denies involvement. Kim Yo Jong, sister of leader Kim Jong Un, described the accusations as a “sinister attempt” by the US to damage the country’s image, according to the BBC. The Guardian, citing the state news agency KCNA, reports that she called the US assertion absurd. Pyongyang has repeatedly rejected responsibility for a number of large-scale hacks attributed to it in recent years.

What happens next

Binance says it has rebuilt the wallet system and the AI tool that was breached, replaced compromised devices, and cancelled credentials and tokens linked to the engineers involved. It has also widened security scans across employee computers. The company plans to spend more on AI tools that spot threats, bring in outside specialists for a full review, and set up a security research fund with AI and security firms.

Teng said an independent expert will review the company’s work, and that the investigation and efforts to freeze the stolen funds are continuing.

Frequently asked questions

What is social engineering?

Social engineering means tricking people into giving up sensitive details or access, often through messages that look trustworthy. Binance says the attackers used this approach to build trust with its engineers before sending malware.

Has Binance recovered the stolen money?

Binance says it has frozen or intercepted part of the funds and has set aside more than 100% of the amount needed to cover the loss. Its figures show 98% of the affected token assets had been restored as of Saturday.

Who has been blamed for the hack?

The FBI has said North Korea was responsible, and Binance’s post on X points to that finding. North Korea has denied involvement and described the accusation as absurd.