Skip to content
North Korean Hackers Use Fake Job Interviews to Steal $6.34 Billion from Binance

North Korean Hackers Use Fake Job Interviews to Steal $6.34 Billion from Binance

First seen 13 Nov 2026, 18:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 13, 2026 at 18:49 UTC
  • •Binance lost $6.34 billion in a North Korean cyberattack linked to fake job interviews.
  • •Malicious npm packages were available for months, leading to widespread downloads.
  • •Employers must verify developer machines for potential malware from recruitment interactions.

On October 29, 2026, Binance reported a theft of $6.34 billion from its hot wallets, attributed to North Korean hackers. The attack involved a fake job interview where a software engineer was lured to download malicious code disguised as a coding assignment. This incident marks the largest cryptocurrency theft to date. The attackers used a fake company, AccuraSoftHire, to facilitate the recruitment process, which included identity-verified profiles and job postings. JFrog's research revealed that some malicious npm packages remained available for months, accumulating over 4,000 downloads. Binance's security measures failed to detect the malware, leading to further compromises within their engineering team. Employers are advised to check developer machines for signs of compromise and treat any affected credentials as stolen.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-10-29
Binance reports theft of $6.34 billion
The theft from Binance's hot wallets is attributed to North Korean hackers using a fake job interview as a vector.
Stepsecurity
2026-11-03
Binance publishes initial report
Binance details the attack and its connection to a fake job interview scheme involving malicious downloads.
Stepsecurity
2026-11-12
Malicious npm packages removed
Two npm packages used in the attack were removed after being available for several months.
Stepsecurity

More articles in this cluster (3)

Following this threat?

Track Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (26)

1 / 3

Common questions

How did the attackers gain access?
The attackers used a fake job interview process to lure a software engineer into downloading malicious code.
What should companies do to protect themselves?
Companies should check for any unauthorized downloads and ensure endpoint security measures are in place.
What evidence links this attack to North Korea?
Binance reported that the FBI attributed the attack to North Korean hackers.