How a Fake Job Interview Led to the $6.3B Binance Heist

How did the Binance heist happen? North Korean hackers, identified by the FBI as TraderTraitor, spent five months working toward Binance’s wallets before draining about $6.34 billion on October 29, 2026. A tampered download in June exposed the wallet team. In September, a fake recruiter got a Binance engineer to run a malicious coding assignment on his work laptop. From there, the attackers used an internal AI tool to reach two wallet engineers, found a container deployment token, got into the internal wallet signing service and moved funds outside the normal withdrawal process.

On October 29, attackers moved about $6.34 billion out of Binance hot wallets in under four hours. Fortune calls it the largest crypto heist in history, and the FBI has attributed it to North Korea.

What matters more than the dollar figure is the route. Binance’s preliminary findings, published November 3, describe a campaign that ran for five months, touched three engineers and reached money only at the very end. The step everything else depended on was a job interview.

Here is the whole route, mapped from Binance’s findings and the reporting around them. After it, I cover what it means for security teams, for anyone who takes recruiter calls, and for go-to-market leaders who want their employees visible on LinkedIn.

Quick answers

How did the Binance hack happen?

Attackers spent about five months working toward Binance’s wallets. A tampered Homebrew download in June exposed the wallet team. In September, a fake recruiter and two staged interviews led a Binance engineer to run a malicious coding assignment on his work laptop. On October 20 the attackers used an internal AI tool to take over two wallet engineers’ machines, found a container deployment token, and on October 29 used it to reach the internal wallet signing service and drain hot wallets.

How much was stolen in the Binance heist?

Binance estimates about $6.34 billion in digital assets were affected on October 29, 2026. As of its November 3 update, about $2.85 billion had been frozen or intercepted, and Binance said it had replenished 98% of affected assets from its own funds as of October 31.

Who was behind the Binance hack?

The FBI attributed the theft to North Korea’s TraderTraitor group, also tracked as Lazarus Group and APT38. North Korea denied involvement.

How did a fake job interview lead to the Binance hack?

Someone posing as a Project Director contacted a Binance software engineer on a job platform, then ran two interviews with a fake HR representative and a fake CEO. At the end, the engineer was asked to download a technical assignment onto his work computer. Setting it up replaced a developer tool with a malicious copy that connected to the attackers, and Binance’s endpoint security did not detect it.

What role did AI play in the Binance hack?

Binance says the attackers used an internal AI tool to move from the compromised engineer’s laptop to two wallet engineers’ machines. Its report does not identify a flaw in the AI model itself. The tool had access that the attacker could reuse, which is why internal AI tools should be treated as privileged identities.

What is EIP-7702 and why couldn’t Binance stop the transfers?

EIP-7702 is an Ethereum feature that lets an account hand some execution rights to a smart contract. The attackers used it to give their own contract partial control of a Binance hot wallet. Because that permission lived on-chain, suspending withdrawals did not stop it, and Binance’s multi-party computation setup meant it needed a special procedure to revoke it, which it completed at 00:10 UTC on October 30.

How can job seekers avoid fake job interview malware?

Never run interview code, take-home tests or assignments on a work computer. Use a disposable virtual machine or a separate device with nothing signed in. Confirm the company and role on the company’s own careers page, and treat outreach that names your current employer and role as a reason for extra care.

Should companies limit employees’ LinkedIn profiles?

Binance says employees in non-public-facing roles may not keep LinkedIn profiles. A balanced approach is to build employee advocacy around public-facing roles such as sales, marketing, research and executives, and not push engineers with production or wallet access to list their employer and team.

Were Binance customers affected?

Binance says customer funds are safe and that it will absorb the loss. Withdrawals were paused for about 48 hours while it contained the incident.

Diagram of the Binance attack route from June to October 30, 2026: a poisoned Homebrew download maps the wallet team, a fake recruiter and two staged interviews lead an engineer to run a malicious coding assignment on his work laptop, an internal AI tool is used to take over two wallet engineers’ machines, a container deployment token opens the internal wallet signing service, and five hot wallets are drained, including through an EIP-7702 delegation that suspending withdrawals could not stop. — The attack route, June to October 30, 2026. Built from Binance’s November 3 preliminary findings and the reporting cited below. Times are UTC.

The route, step by step

1. June: a poisoned download maps the wallet team

An engineer on Binance’s Wallet DevOps team, called Engineer A in Binance’s report, was looking for a popular AI coding tool. He clicked an online ad and installed a tampered copy of Homebrew, the package manager most Mac developers rely on (Fortune, Security Affairs).

Binance caught it. The company replaced his laptop and rotated his credentials. By then the attackers had what they came for: his role, and the names of colleagues who managed the company’s wallets. Binance’s report does not show continuous access from June onward, as StepSecurity points out. It didn’t need to. The attackers left with a target list.

2. September: a “Project Director” reaches out

A different employee, Software Engineer B, received a message on a legitimate job-hunting platform from someone posing as a Project Director. His profile referenced his work at Binance. Fortune reports the platform was LinkedIn.

One detail stands out. A Binance spokesperson told Fortune that employees in non-public-facing roles are not allowed to keep LinkedIn profiles. The company declined to say whether Engineer B broke that policy.

3. Two interviews built to earn trust

The first round was a live video call with an “HR representative,” who shared a social media account full of personal photos and videos to look credible. The second round was with someone posing as the CEO of a company that doesn’t exist, held over a social chat app (Security Affairs, Tom’s Hardware).

None of this is exotic. It’s a normal hiring process, played straight.

4. The take-home assignment

Near the end of the CEO interview, Engineer B was asked to download a technical assignment, a code repository, onto his work computer. When he set it up, the code replaced a legitimate component of a developer tool with a malicious copy, hid itself with obfuscation, ran commands and called out to a server the attackers controlled (Security Affairs). The file sequence Binance published points to pyenv, a Python version manager installed through Homebrew (StepSecurity).

Binance says its endpoint security tools did not detect it.

5. October 20: an internal AI tool opens two more doors

From Engineer B’s laptop, the attackers used an internal AI tool to take control of two more machines: Engineer A’s, the wallet engineer from June, and Wallet Software Engineer C’s (Fortune, Security Affairs). Binance hasn’t named the tool or explained how it was abused. Its report doesn’t point to a flaw in the AI model. The tool had access, and the attacker reused it.

On Engineer A’s machine they found what mattered most. In Binance’s words, as quoted by Fortune, “the attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.”

6. October 29, afternoon: from a laptop to the signing service

Between 17:15 and 19:56 UTC, the attackers worked through Engineer C’s computer using Engineer A’s credentials, deployed a container and ran a malicious script (StepSecurity). That gave them Binance’s internal wallet signing service, which they used to start transactions outside the normal withdrawal process (Security Affairs).

Binance says it found no evidence that a wallet private key leaked (Jamf). The attackers didn’t need the keys. They had the service that uses them.

7. October 29, evening: the drain, and the permission that outlived the shutdown

Funds started leaving at 20:05 UTC (CoinDesk). Within four minutes, five hot wallets sent about 233.46 million XRP to an attacker address. Transfers of roughly 970,500 SOL, 44.2 million OP and 18,270 BTC followed (Security Affairs, SecurityOnline).

On Ethereum, the attackers used EIP-7702, a feature that lets an account hand some execution rights to a smart contract, to give their own contract partial control of a Binance hot wallet. That’s why suspending withdrawals didn’t stop everything. The permission lived on-chain, outside Binance’s withdrawal system. And because Binance’s hot wallets use multi-party computation, no single key could revoke it, so Binance had to build a revocation procedure on the spot.

The last transfer, 2,961.9 ETH, settled at 23:56 UTC. Binance cleared the delegation at 00:10 UTC on October 30.

The aftermath

By November 1, the FBI had attributed the theft to North Korea’s TraderTraitor, also tracked as Lazarus Group and APT38. The FBI said the hackers were converting stolen assets mainly into Ethereum and expected them to launder more through decentralized finance and instant swap services, and it asked exchanges to block the wallet addresses involved (Korea Times). North Korea called the claims “preposterous nonsense” (Tom’s Hardware).
As of Binance’s November 3 update, about $2.85 billion had been frozen or intercepted (Blockchain.News), helped by Tether and Circle freezing stolen stablecoins (Fortune).
Binance says it had replenished 98% of affected assets from its own funds as of October 31 and will absorb the loss. Withdrawals were halted for about 48 hours.
Binance also says it detected and stopped 57 suspected North Korea-linked attempts in 2026 before this one got through.
Its statement to users: “This should not have happened, and we apologise for the concern, disruption and uncertainty it caused.”

The playbook isn’t new. In September, a joint advisory from Japan’s National Police Agency, the FBI and partners in Australia and Germany described WaterPlum, also called Contagious Interview, a North Korean fake-job campaign that had infected more than 30,000 devices and compromised over 7,000 crypto wallets (Security Affairs). Binance shows what the same approach looks like when it lands on the right engineer.

Why it worked

Binance called it “a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident.” Co-CEO Richard Teng said it “was a campaign, built over many months” (CoinDesk).

Both are true. But look at the steps one at a time and none of them needed a breakthrough. My read is that the route depended on five ordinary gaps lining up:

Public role data. A profile that names the employer and the job tells an attacker exactly whom to approach.
A hiring process nobody questions. Two rounds, a believable HR person, a CEO. Candidates are conditioned to complete take-home tests, not to suspect them.
Interview code on a work machine. The one decision that put a hostile repository a few hops from production.
Tools with more reach than any one person needed. An internal AI tool that could be turned into a path to other engineers’ machines, and a deployment token sitting on a laptop.
A signing service that would sign outside the withdrawal flow, and an on-chain permission that a shutdown couldn’t reach.

Close any one of them and the route probably breaks, or at least gets much louder.

What to do about it

If you take recruiter calls

Never run interview code, take-home tests or “assignments” on a work computer. Use a disposable virtual machine or a separate device with nothing signed in.
Confirm the company and the role on your own. A real role shows up on the company’s own careers page or applicant tracking system, not only in a direct message.
Treat outreach that references your current employer and role as a reason for more care, not less.
If your job touches privileged systems, tell your security team when a recruiter approaches you. Binance had already flagged LinkedIn targeting of its staff before this happened.

If you run security or engineering

Treat internal AI tools as privileged identities. Scope what they can reach, log what they do and control who can drive them.
Get long-lived deployment tokens off laptops. Make them short-lived, narrowly scoped and tied to a verified device.
Watch developer machines for swapped binaries in package manager paths, not only for known malware signatures.
Make signing services refuse anything that didn’t come through the approved withdrawal flow, and rehearse a fast way to revoke on-chain delegations before you need it.

If you run go-to-market

This is the part that rarely comes up. Most of us push employee advocacy: get the team on LinkedIn, posting, tagged and visible. Binance went the other direction. Employees in non-public-facing roles may not keep LinkedIn profiles at all.

Both can be right. Visibility is a go-to-market asset for sellers, marketers, researchers and executives whose job is to be found. It’s a liability for the people who hold the keys. A sensible split:

Build advocacy programs around public-facing roles. Don’t push engineers with production or wallet access to list their employer and team.
Publish how real recruiting works at your company: the email domains, the platforms you use, and a plain statement that you never ask candidates to run code on an employer device.
Brief your recruiters and hiring managers. If attackers can invent a company to recruit from, they can borrow yours.

The money moved in four hours. The decision happened in September.

The Binance heist will be remembered for its size. It should be remembered for its route. The funds left in under four hours on October 29. The step that made it possible happened weeks earlier, in an interview, on a work laptop, with a candidate doing exactly what candidates are asked to do.

Binance describes its findings as preliminary, and details may change. This post reflects what was public as of November 4, 2026.

The $6.3 Billion Binance Heist Started With a Job Interview