Binance Traces Record $6.3 Billion Crypto Theft to Fraudulent Job Interview and Tool

1. Binance said a fake job interview and a tampered developer tool gave hackers their foothold for the record $6.3 billion crypto theft on October 29.

2. Investigators said the attackers exploited an Ethereum feature and Binance’s own AI tool to seize wallets and drain funds in minutes.

3. The FBI blamed North Korea’s TraderTraitor unit, a finding Pyongyang rejected.

Binance said Tuesday that hackers tricked one of its wallet engineers with a fake job interview, part of a months-long operation that drained $6.3 billion in cryptocurrency from the exchange on October 29, in what blockchain investigators and the FBI describe as the largest crypto theft on record.

The company, the world’s largest crypto exchange by trading volume, said in a report posted to X that the intrusion began in June and ran through two separate employee compromises before the attackers reached systems that controlled billions of dollars in assets. The FBI attributed the theft to TraderTraitor, a North Korean state- unit.

Inside the Four-Month Break-In

In September, a second engineer seeking a new job was contacted on a job-hunting platform by someone posing as a project director at a fictitious company, Binance said. A first-round video call featured a fake human resources representative, and a second interview on a chat app included a person presenting themselves as the company’s chief executive. The engineer was then asked to download a coding assignment that carried malicious code. Binance said its security tools did not flag the file.

On October 20, the attacker used the compromised laptop and an internal Binance artificial intelligence (AI) tool to take over the systems of two wallet developers, the company said. Nine days later, the attacker worked from the second developer’s computer, using credentials stolen from the first, and triggered a script that launched the theft.

The Mechanism and the Money

Blockchain analysis firm TRM Labs said the attacker exploited EIP-7702, an Ethereum feature introduced in 2025 that lets a standard wallet temporarily hand control to a smart contract. The hackers used it to turn a Binance hot wallet, an internet-connected account, into a sweeper they controlled, preparing 50 signed authorizations in advance so one would execute.

The theft moved quickly. Binance said attackers pulled 233.46 million XRP from five hot wallets to an address they controlled in four minutes, then took bitcoin and other assets. The final unauthorized transfer came nearly four hours later, at 2356 GMT.

Binance said it froze or intercepted $2.85 billion and has set aside $6.34 billion of its own funds to repay affected customers. It recorded 57 suspected North Korea-linked intrusion attempts in 2026.

The FBI said Saturday it had observed TraderTraitor converting the stolen funds mainly into Ether and published wallet addresses tied to the group, the same actors it blamed for the $1.5 billion Bybit theft in February 2025. Kim Yo-jong, sister of North Korean leader Kim Jong Un, called the accusation “absurd rhetoric” through state news agency KCNA .

North Korean operatives have long worked the other side of hiring, posing as job applicants to land remote roles at Western firms and route salaries to Pyongyang.

Data from Pindrop Security showed suspected North Korean applicants rose from 1 in 343 job applications in 2025 to 1 in 47 in 2026. The Binance breach used the same playbook, but targeted a recruiter rather than an employer.

What’s : The FBI asked crypto services to block addresses linked to the laundering, and Binance said it would bring in outside security experts to review the incident.

Binance , 29 October Binance Security Incident: Initial Findings and Response Update,” Nov. 3, 2026.

TRM Labs , “North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History,” Oct. 29, 2026.

Reuters , Howcroft and Vicens, “Binance hackers used fake job interview in $6.3 billion attack,” Nov. 3, 2026.

TechCrunch , Zack Whittaker, “Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist,” Nov. 3, 2026.

Axios , Sam Sabin, “Binance’s $6.3 billion hack began with a fake job,” Nov. 4, 2026.

Stay Ahead of Global Conflict, Security, and Technology.

Get the #1 daily intel report for decision-makers on global conflict, security, and technology. Over 72,000 leaders trust The SOFX Report to deliver apolitical, fact-based news on issues impacting their lives.