Binance hack: the attack began with a fake job interview

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

The largest theft in the history of the crypto market started with a job interview. On November 3, 2026, Binance published a first incident report on the hack of October 29. According to the report, the attackers did not reach the exchange's hot wallets with a stolen key but through months of groundwork: a tampered software package in June, a fake hiring process in September and an internal AI tool in October. Binance puts the damage at more than $6.3 billion.

For the exchange's customers, the report changes little the current situation. Binance says around 98 percent of the affected holdings have been replaced with company funds, and it is reopening withdrawals step by step. The method matters more. The same scheme of fake job offers and poisoned test assignments has been aimed at developers, freelancers and retail investors for years, and a handful of habits are enough to fend it off.

Binance incident report: how the $6.3 billion hack began

Binance released the report on Tuesday through its own channel on X, alongside a press briefing with security chief Jimmy Su, which CoinDesk reported on. In its summary of the report, The Block cites a figure of $6.34 billion. Both outlets describe the same four-stage sequence, which stretched over five months.

On October 30, Binance had briefly attributed the cause to a compromised laptop in the DevOps team . The new report explains how the attackers got hold of that device and why a single computer was enough. Co-CEO Richard Teng summed it up on X, paraphrased: this was neither a single mistake nor a single breach, and the perpetrators had run a campaign over several months.

The four stages at a glance

June 2026: An engineer on the wallet DevOps team installs a tampered Homebrew package.

September 2026: A second employee downloads a rigged coding assignment onto his work computer as part of a fake hiring process.

October 20, 2026: Through this computer and an internal AI tool, the attackers take over the devices of two wallet engineers.

October 29, 2026, 20:05 UTC: Using stolen credentials, they launch a container running a malicious script, and the funds start to drain.

Fake hiring process: the coding test with zero-day malware

The decisive foothold was gained in September. According to Su, a software engineer was contacted through a genuine job platform. The sender posed as a project manager. A video call followed with a supposed HR manager, who shared a social media profile with private photos to build trust. A purported company chief appeared in a second call.

It ended with a coding assignment of the kind that is common in technical hiring. The engineer downloaded it onto his work computer. According to Su, the file contained zero-day malware that bypassed the device's endpoint protection. A zero-day vulnerability is a flaw the security software vendor does not yet know , which is why no detection exists for it at the time of the attack.

The pattern is not new. The FBI warning of September 3, 2024 describes exactly this approach: the perpetrators study professional networks, build trust through lengthy conversations, appear as several people and finally get their victims to run code, for example as a hiring test or as debugging with unfamiliar packages.

Tampered Homebrew package: the first breach in June

Homebrew is a widely used package manager for macOS that lets developers install programs from the command line. According to the report as relayed by The Block, an engineer on the wallet DevOps team was looking for an AI coding tool in June and ended up with a tampered installation.

Internal AI tool: hopping from machine to machine

On October 20, the attackers put the computer infected in September to use. Through an internal Binance AI tool, they reached the computers of two engineers on the wallet team. On one of these devices they found a permission to launch containers in the production environment. A container is a self-contained software environment in which a program runs with exactly the rights assigned to it.

Nine days later, on October 29, they used that permission. They launched a container and ran a script inside it that triggered the attack on the wallet infrastructure. According to the report, the AI tool helped both with the jump between computers and with access to the wallets' signing environment.

EIP-7702 and the MPC wallet: containment took just over four hours

According to CoinDesk, funds began leaving the exchange at 20:05 UTC. The attack was not contained until 00:10 UTC on October 30. Su gave the reason at the press briefing: the attackers exploited EIP-7702, an Ethereum extension from the Pectra upgrade that lets a regular account temporarily take on the logic of a smart contract. That gave them execution rights over a hot wallet.

Binance secures its hot wallets with multi-party computation (MPC). The private key never exists in one place; several parties generate every signature jointly. That protects against the theft of a single key. In Binance's case it had a downside: according to Su, no single key could revoke the permission that had been granted, which is why containment dragged on past midnight.

North Korea and TraderTraitor: what the FBI alleges and Pyongyang denies

The FBI attributes the attack to the North Korean group TraderTraitor. In its report, Binance itself speaks of social engineering, malware and compromised AI tools, and says it has already repelled 57 suspected North Korean attack attempts using similar methods in 2026.

North Korea rejects the attribution. According to The Block, the sister of leader Kim Jong-un on Monday called the FBI's claims a "grave political provocation." There is so far no solid evidence pointing to anyone else; the attribution remains an assessment by US authorities.

Frozen, replaced, SAFU halved: where Binance customer funds stand

Binance says it has frozen or intercepted around $2.85 billion and topped up 98 percent of the affected holdings with company funds. Teng stresses that users are not affected by the loss. Since 04:00 UTC on November 3, the exchange has been reopening withdrawals in phases for dozens of tokens on BNB Smart Chain, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base. The tokens with the highest demand over the past week came first. After that, hourly deposits exceeded withdrawals, according to Binance.

To compensate users, Binance is also drawing on the SAFU fund, the exchange's emergency fund for user losses. According to CoinDesk, citing data from mempool.space, the fund's bitcoin holdings fell from 15,000 to just over 7,500 BTC through four transactions on October 31. At a bitcoin price of around $77,600 on Tuesday afternoon, according to CoinGecko, that is roughly $580 million. Binance has pledged to refill the fund to around $1 billion without giving a date. The exchange token BNB traded at around $700 at the same time, 0.4 percent below the day.

As consequences, the report lists closed entry points, rebuilt or replaced systems, stricter device controls and expanded, AI-assisted detection of unusual behavior. Binance is also commissioning an independent cybersecurity audit.

How to protect yourself from fake recruiters and malware in test assignments

What happened: In September 2026, attackers contacted a Binance engineer through a job platform, held video calls under false identities and got him to open an infected coding assignment on his work computer. On October 29, more than $6.3 billion drained out through this route (Binance incident report, as of November 3, 2026).

Are you affected? As a Binance customer you do not have to bear any loss, according to the exchange; your balance is being replaced and withdrawals are returning in phases. You can be hit by the same scheme if you work in the crypto industry, write code or apply for jobs with a crypto connection. A warning sign is an unusually fast, well-paid offer that leads to a task requiring you to download and run unfamiliar files.

Verify identity separately: Call the company on a number or address you looked up yourself before accepting an invitation to a second interview, and never rely on details from the recruiter's message.

Test assignments only in isolation: Open coding tasks from hiring processes only in a virtual machine with no access to your wallets, passwords and company accounts, as the FBI recommends.

No seed phrase on connected devices: Never store recovery phrases or private keys on a computer, phone or in the cloud; malware searches exactly these places first.

Software only from the original source: Install developer tools, AI assistants and browser extensions only via the link on the vendor's site, and check names and publishers carefully in package managers.

Larger amounts offline: Keep what you do not trade on a hardware wallet, and use a separate wallet with a small balance for tests, DeFi and airdrops.

Our guide how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison lines up the right devices.

Social engineering refers to attacks that target people rather than technology: perpetrators gain trust and get their victim to carry out the decisive action themselves. At Binance, that was downloading a test assignment. For retail investors, it is usually approving a transaction, entering the seed phrase or installing a supposedly useful app.

Fake job offers are a recurring route. Besides hiring tests, the FBI also lists supposed investment offers and approaches from well-known industry figures that rely on stolen photos and cloned company websites. Anyone who manages crypto on the same computer they use to open unfamiliar files carries, on a small scale, the same risk Binance faced on a large one.

The case also shows that good key management alone is not enough. Binance used MPC and replaced the device after the first incident in June. That did not stop the attack, because the perpetrators stole permissions rather than keys and kept their knowledge of the team. For investors, this means keeping the devices you work and browse on separate from the device you sign with.

Binance hack: one job interview opened the way to $6.3 billion

The incident report turns the record hack into a case of personnel security. Three steps help you apply its lesson to your own holdings:

A separate wallet for testing: Set up a dedicated software wallet with a small balance for DeFi, airdrops and new applications. You will find suitable apps in the software wallet comparison .

Keep long-term holdings offline: What you do not trade belongs on a device that never runs third-party code. Models and prices are in the hardware wallet comparison .

Choose exchanges by license: For the balance you leave on a trading platform, what counts is EU authorization, proof of reserves and clear compensation rules. Providers with a MiCA license are listed in the comparison of regulated crypto exchanges .

(As of November 3, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions the Binance hack

According to Binance's incident report of November 3, 2026, attackers infected an engineer's work computer in September via a rigged coding assignment from a fake hiring process. Through that computer and an internal AI tool, they reached the wallet infrastructure in October and triggered the outflow of more than $6.3 billion on October 29.

The FBI attributes the Binance hack to the North Korean group TraderTraitor. North Korea denies this and calls the claims a political provocation.

Binance says around 98 percent of the affected holdings have been replaced with company funds and that users bear no loss. Since November 3, the exchange has been reopening withdrawals step by step for dozens of tokens.

Verify a recruiter's identity through a you looked up yourself and open test assignments only in an isolated virtual machine. Your seed phrase and private keys never belong on a connected device, and larger holdings belong on a hardware wallet.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Section: All crypto hacks and scams at a glance

North Korean Hackers Drain 7,000 Crypto Wallets: What to Check on Job Offers and Coding Tests

Binance hack: FBI names North Korea and lists more than 600 addresses

North Korea Behind the Binance Hack? Everything We Know the $6.3 Billion Theft

Binance Hack Conspiracy Theories: Fact-Checking CZ, Trump and the Midterms

Biggest Crypto Hack Ever? Binance Joins the List of Exchange Hacks

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

February 21, 2025 9:55 PM

Bybit Hack Revealed: Here's the Mastermind Behind the $1.46 Billion Theft

The Bybit hack has been traced back by the blockchain investigator ZachXBT, with conclusive evidence linking the hackers to the $1.46 billion theft. Full details revealed...

October 30, 2026 3:32 PM

Binance puts the hack at $6.3 billion: what you can do now

Binance names a cause itself for the first time: a compromised laptop belonging to a DevOps engineer is said to have opened access to a service container, while private wallet keys are said not to have leaked. The exchange estimates the total damage at around $6.3 billion, with $3 billion considered frozen.

September 15, 2026 10:14 PM

AI Crypto Crime: How Scams Are Getting More Convincing

AI is sharpening fake support, deepfakes and phishing across the crypto space. Why the data still needs a careful reading and which security routines protect a wallet.

August 23, 2018 5:37 PM

North Korea Hacks Crypto Exchange With First-Ever macOS Malware

Hackers from North Korea were able to hack into a cryptocurrency exchange with a malware that was developed to target both Windows and macOS systems.

October 20, 2026 10:27 PM

Ethereum from the Drift hack: the attacker moves up to $61 million into Tornado Cash

Wallets attributed to the Drift attacker forwarded between 13,400 and 25,700 ether to Tornado Cash on October 20 after two quiet months. Around 81,500 ether still sit with the attacker.

October 5, 2026 1:29 AM

Chainalysis attributes $387 million from the Bitget hack to North Korea: what matters now for investors in Germany

The analytics firm Chainalysis attributes the theft of around $387 million at Bitget to actors with ties to the DPRK and puts the annual total above one billion dollars. What that means for custody, choice of exchange and record-keeping in Germany.

October 30, 2026 9:14 AM

How Much Would It Take to Bankrupt Binance? The $6 Billion Hack Explained

Binance lost $6.3 billion in the biggest crypto hack ever. How much would it take to bankrupt the exchange, and what does it mean for the crypto market?

November 3, 2026 1:58 AM

Crypto Hack News: Every Attack Since the Binance Hack and How to Stay Safe

Binance, Mercado Bitcoin, BTCPay Server, a WordPress plugin and hijacked WhatsApp accounts: since 29 October hardly a day has passed without a crypto hack. Every case with its status, the loss and the steps that keep you safe now.

October 31, 2026 12:36 AM

Binance Hack, Then a Stock Market Crash: Coincidence or Connection?

The largest crypto theft in history on Thursday evening, Wall Street's worst day since June on Friday. Are the Binance hack and the stock market crash connected? Our analysis of timeline, sizes and money flows, and where crypto and stocks really meet.

January 22, 2025 11:31 AM

How to Identify Fake TRUMP tokens: A Guide to Staying Safe in the Crypto World

The rise of fake TRUMP and MELANIA tokens is alarming crypto enthusiasts. Learn how to distinguish the official tokens from scams and protect your investments with this essential guide.

May 15, 2024 12:04 PM

Crypto Scams: How to Protect Your Cryptos?

With the rise of crypto scams, and while international efforts are still working to combat these threats and protect investors, some recent tactics have been identified, and here is your full guide.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.

October 30, 2026 12:40 PM

Binance SAFU fund: full reimbursement pledged for $6.3 billion

Binance puts the damage from the attack of October 29, 2026 at around $6.3 billion and intends to carry all losses, from the SAFU fund and from company funds. The fund holds 15,000 bitcoin, which at the current price comes to barely a fifth of the damage.

October 29, 2026 9:40 PM

Crypto Crash After Binance Hack: $628 Million Liquidated in One Hour

At 20:24 UTC a Binance hot wallet was drained of $2.8 billion. Within an hour Bitcoin fell below $79,000 and BNB lost 6.3%. Here is the minute-by-minute timeline, the prices of all major coins and what could come as Asia wakes up.

July 18, 2026 6:49 PM

FBI Arrests Florida Student for Hiding Crypto-Stealing Malware in Steam Games

The FBI arrested a 21-year-old accused of hiding crypto-draining malware in Steam games, stealing $220,000 from roughly 80 wallets. Here's how it happened.

October 29, 2026 10:40 PM

Binance Withdrawals After the Hack: Solana and XRP Paused, Bitcoin and Ethereum Open

Binance has confirmed the hack: co-founder Yi He says the exchange will cover all losses, and deposits and withdrawals are temporarily suspended. What it means for users, which networks were already paused and what to watch out for now.

October 16, 2026 4:15 AM

241 scam sites taken offline, the recovery scam lives on: what to check now

The Brooklyn District Attorney and the FBI shut down a fraud network of 241 websites and 112 servers on 14 October 2026; the second stage of the scheme was a purported recovery service. Five days earlier, German regulator BaFin had warned exactly this pattern at a purported bank.

October 31, 2026 12:37 AM

Binance Alternatives: 4 MiCA-Licensed Exchanges Compared

After the hack of 29 October 2026, many Binance customers are looking for a new for their coins. Bitpanda, Kraken, Bitvavo and Coinbase are licensed under MiCA. Here are their fees, supervisors and a five-step guide to moving.

November 3, 2026 8:28 AM

Why Is Crypto Down Today? The 5 Reasons Behind the November 3 Sell-Off

Why is crypto down today? Bitcoin sits near $76,000 after the Binance hack, a hawkish Fed and a Nasdaq slide. The five drivers, explained.

September 5, 2026 10:24 PM

Fake German Finance Ministry Letters: Why Nobody May Demand 19 Percent VAT on Your Crypto Purchase

Since September 1, 2026, Germany's Federal Ministry of Finance has been warning forged letters that demand 19 percent VAT on cryptocurrency purchases while citing real transactions. That tax does not exist, and this is how to spot the forgery.

October 20, 2023 9:53 PM

How to Keep Crypto Safe

After the $6.3 billion Binance hack: how to keep crypto safe. Hardware wallets compared, wallet scanners such as MetaMask security alerts, the exchange settings that matter and a seven-step checklist.

October 31, 2026 3:15 PM

$6.34 Billion Buffer: Binance Promises a Full Proof of Reserves by Monday

Binance says it will present a full proof of reserves by Monday and has set aside more than $6.34 billion for it. What a proof of reserves proves, what it leaves open and how you find your own balance in it.

October 31, 2026 12:48 AM

Crypto Weekly Recap: Binance Hack, Wall Street Crash and Gold Under Pressure

The largest crypto theft in history, Wall Street's worst day since June and a Fed that turns hawkish: week 44 of 2026 in numbers, the five events that mattered, winners and losers among the top coins and what crypto investors should watch week.

November 2, 2026 9:43 PM

How to store crypto safely: protect yourself from hacks like the one at Binance

After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.

October 29, 2026 9:59 PM

BNB Crash: Binance Coin Drops 6% After the Hack. Is This Another FTT Moment?

BNB fell 6.3% within 35 minutes after a Binance hot wallet was drained, the worst performer of the top ten cryptocurrencies. Not one BNB was stolen. Why the token falls anyway, how it compares with FTT in 2022 and which price levels matter now.

October 29, 2026 9:49 PM

Is This the End? How Low Bitcoin Could Fall After the Binance Hack

$2.8 billion left a Binance hot wallet and Bitcoin slid below $79,000. Whether this turns into a real crash depends on one question. Three scenarios, the key price levels for Bitcoin, Ethereum and Solana and what to do now.

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

More from CryptoTicker