Through a fake job interview: Binance reveals details of the largest hack in cryptocurrency history

Binance reported that North Korean hackers used a combination of social engineering and malware to carry out last week’s theft of $6.3 billion, the largest in the history of cryptocurrency. UNN writes about this, citing Fortune.

Details

In conversations with journalists, company executives said that the hackers targeted a Binance engineer on LinkedIn and organized a series of fake interviews to persuade the employee to download an "assignment" that allowed them to infiltrate the company’s systems.

In a related report, Binance explained: "Software Engineer B was contacted by a person posing as a project director through a legitimate job-search platform. Software Engineer B had a profile on the platform that mentioned his work experience at Binance. The person posing as a project director arranged a first-stage interview with a human resources representative, followed by a second-stage interview with a person who claimed to be the CEO of a fictional company."

The report also provided additional details about the complex, months-long scheme, which involved not only a fake hiring advertisement on LinkedIn but also a separate advertising campaign that tricked another engineer into downloading a malicious version of the popular Homebrew software package.

According to Binance, the engineer did not download the Homebrew software through the company’s usual channels, but instead clicked on an online advertisement promoting a modified version.

Binance claims that it detected the download of the fake Homebrew and removed it from the employee’s computer, but by then the hackers had discovered important information about the engineer’s role and the other people managing the company’s wallets.

It was precisely the combination of these tricks—the fake LinkedIn outreach and the information obtained from the modified version of Homebrew—that enabled the North Korean hackers to seize a number of Binance wallets and withdraw funds from them.

Although many initially assumed that the hackers had used AI to breach Binance, the company’s report shows that they instead relied mainly on traditional phishing methods. At the same time, Binance added that AI did play a role. This happened when the hackers, after gaining control of the engineer’s laptop, used Binance’s own internal AI tools to compromise other accounts.

"The attacker used the compromised computer of Engineer B and an internal AI tool to gain control of Wallet DevOps Engineer A and another wallet software engineer, C. Shortly afterward, the attacker discovered that Wallet DevOps Engineer A had a token authorizing container deployment on his computer," the Binance report said.

According to a Binance representative, employees whose positions do not involve public interaction are prohibited from maintaining LinkedIn profiles. The representative declined to clarify whether the engineer in question violated this rule or whether both engineers would be dismissed.

The Invasion of North Korean "Recruiters"

The phenomenon of North Korean hackers posing as recruiters has become a widespread problem in the corporate sector as a whole. In Binance’s case, the company said it had previously tracked attempts by hackers to target its employees on LinkedIn and that in 2026 it detected and prevented 57 hacking attacks linked to North Korea.

After the attack, which occurred over several hours on Thursday, the company reported that the hackers had stolen approximately $6.3 billion, but that it managed to recover about $2.5 billion after two companies, Tether and Circle, froze the stolen stablecoins.

In response to the breach, Binance suspended withdrawals for approximately 48 hours but resumed them on Saturday. The company has repeatedly stated that all customer funds are safe and that it replenished 98% of the stolen coins from reserve funds and other sources. It is currently working to recover the remaining 2%, which consists of less commonly used currencies.

"This should not have happened, and we apologize for the concern, disruption, and uncertainty it has caused our users, partners, and the entire industry," Binance said in a statement.

$4.7 billion withdrawn from Binance after the largest cyberattack02.11.26, 17:00 • 4796 views