Binance hackers used fake interviews and social media profiles in $6.3bn heist

Binance said the attackers who stole $6.3bn from the crypto exchange last week set up fake job interviews to trick a software engineer at the company into installing malicious code, as it laid out findings from an investigation into the heist.

“It was not a single isolated breach or a simple phishing incident. The attackers combined a range of techniques, including . . . fake recruitment interviews, malicious software downloads” and other methods, Binance said on Tuesday.

The FBI on Saturday blamed TraderTraitor, a group of hackers linked to North Korea, for the theft of $6.3bn from Binance in the biggest heist on record. The attack came as advances in artificial intelligence have driven an increase in such hacks in crypto, revealing vulnerabilities in blockchain technology.

But Binance’s findings underscore the significant role of human error in allowing the hackers to gain access to the exchange’s systems.

Binance said that in June one of its engineers had downloaded a tampered software programme. This was detected by Binance’s systems and the engineer’s device was replaced, but not before the engineer’s “role and his related colleagues on our wallet infrastructure team [had been] exposed to the hacker”, the company said.

In September, a second Binance engineer was contacted through a job-hunting platform by a person claiming to be a project director at what turned out to be a fake company. The engineer took part in what they thought was a job interview, during which the interviewer shared their social media profile, “including personal photos and videos posted on the platform, in order to build trust”, Binance said. It described the episode as “more advanced and deceptive than previously seen social engineering approaches”.

At a second interview with a person claiming to be the CEO of the fake company, which took place over a social chat app, the interviewer instructed the engineer to download an interview assignment, which contained malicious code. This download went undetected and allowed the attackers to use Binance’s internal AI tools to gain control over some of the exchange’s systems.

“The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server,” Binance said.

With the malware in place, attackers used the engineer’s compromised laptop and a Binance AI tool to control the laptops of the first and a third engineer. The first engineer had the ability to publish code, which the hackers used to their advantage.

On October 29, the day of the hack, the attackers logged on to the third engineer’s laptop and “triggered a malicious script to launch the attack”.

Recommended

Binance said it had since rebuilt its wallet systems and AI tools, and was working with external cyber security experts to strengthen its security systems. It said it had set aside enough funds to cover users’ losses and had restored its customers’ ability to withdraw funds.

It also said it would keep some details of its security measures confidential, “to prevent malicious actors from using them to plan future attacks”.

Binance co-chief executive Yi He said that so far in 2026 the company had detected and neutralised 57 suspected North Korean cyber threats.

“We intercepted many of them, but the cost of failing to stop even one was severe — and this should never have happened,” she said.