Binance Hack: Fake Job Interview Let Hackers In

The record Binance hack started with a fake job offer. Binance said on Tuesday, November 3, that hackers spent weeks gaining a Binance engineer's trust through fake interviews. They then got him to download a malicious "assignment" that let them steal more than $6 billion in crypto, NPR reported.

The FBI has blamed North Korea for the theft, the largest crypto heist on record. Pyongyang denies it.

How the attack worked

According to Binance's initial assessment, as reported by NPR:

• In June, the hackers tried to break into Binance's systems. The exchange spotted and stopped them, but the attempt taught the attackers more about its setup.
• In September, a person posing as a "project director" at a company that did not exist contacted a Binance engineer on a job platform.
• A supposed HR officer held a first interview and shared social media accounts, photos and videos to "build trust".
• In a second interview with the fake firm's "CEO" on a chat app, the engineer, using his work laptop, was asked to download an assignment. It contained malicious code.

The final theft last week may have taken only about 20 minutes. Chainalysis said the attackers then used access to an internal AI tool to move deeper into Binance's systems.

"This should not have happened," Binance said, apologising to users and partners. It called the scheme "more advanced and deceptive" than previous social engineering attacks.

North Korea denies involvement

The FBI says the hack was carried out by TraderTraitor, a North Korean state-backed group also known as Lazarus. The same group was blamed for the $1.5 billion Bybit theft in 2025. The BBC reported that Kim Yo Jong, sister of leader Kim Jong Un, called the claims "absurd rhetoric" and a "sinister attempt" by the US to damage North Korea's image.

Are Binance users covered?

Binance has said it will cover the losses itself and that users will not pay. A company spokesperson told the BBC that about 95% of the stolen assets had been covered so far, and that a net $4.72 billion had been withdrawn since trading resumed on Sunday. The spokesperson said this was a small share of about $157 billion in total assets. Binance is also ordering an independent security review.

Lessons for job seekers and companies

Chainalysis says North Korea-linked fake-interview scams have cost victims more than $14.3 million in the past 18 months. Simple steps help:

• never run test files or "assignments" from recruiters on a work computer;
• check that a company and its staff are real before an interview;
• be careful when a recruiter moves the talk to a private chat app;
• companies should limit what staff with access to sensitive systems can install.

More: our Binance review and the Android TV box botnet warning.

Photo: Binance-branded T-shirt and bag, by Bretwa / Wikimedia Commons, CC BY-SA 4.0. File photo.