The $6.3 Billion Heist Began With a Job Interview

Binance says the largest theft in crypto history needed no broken code. It needed five months, three engineers, and a job interview that never happened.

5 min read

How do you steal $6.3 billion from the most security-obsessed company in crypto without breaking a single line of its code?

On Tuesday, Binance answered that question itself. The exchange published its initial account of how roughly $6.34 billion left its hot wallets on October 29 — the theft this site covered as it happened in Twenty Minutes, $6.3 Billion Gone — and the FBI has attributed it to TraderTraitor, a North Korean state hacking group. Publishing the autopsy was a business decision, and it is worth reading as one. But first, the answer to the puzzle: nobody picked the lock. Over five months, the attackers talked their way into jobs at the locksmith.

The first attempt came in June. An engineer on Binance’s wallet DevOps team went looking for a popular AI coding tool and installed a tampered copy of Homebrew, the standard Mac software installer. Binance’s security team caught it. They replaced his laptop and reset his credentials. What they could not take back was what the attackers had already learned: who worked on the wallet team, and what those people could reach.

The second attempt was the interview. In September, a man posing as a project director contacted another Binance engineer through a legitimate job platform — the engineer’s profile mentioned where he worked. The first interview was a live video call with a supposed HR representative, who shared a social media account full of personal photos and videos to build trust. The second was with the “CEO” of a company that does not exist. It ended with a take-home coding assignment, downloaded onto the engineer’s work computer. The assignment carried malware that Binance calls a 0-day: undetected by its endpoint security, it replaced part of a common Python tool and took orders from the attackers’ server.

The third step used the company’s own software. On October 20, working from the infected laptop and through an internal AI tool, the attackers took control of two more wallet engineers’ computers. One of those machines held a token that could deploy software containers. On October 29, signed in on the third engineer’s machine with stolen credentials, they deployed one — and pointed it at Binance’s internal wallet signing service. Funds began leaving at 20:05 UTC. On Ethereum, the attackers used a feature called EIP-7702, which lets a wallet delegate its powers to a program. Because Binance’s hot wallet splits its keys among several parties, no single key existed that could cancel the delegation. The theft ran until 00:10 UTC.

Now the strategy underneath the disclosure. An exchange’s product is not its trading screen. It is the belief that your money is still there in the morning. Binance moved fast to protect that belief: withdrawals restored in phases, about 98% of the affected tokens replenished from company funds, and a public report within five days. Absorbing a $6.34 billion theft without blinking is itself a competitive statement — no smaller exchange could write that check — and telling the story themselves let Binance frame it as a sophisticated state campaign rather than a competence failure. Every rival that sells caution as its brand gets a free sales pitch this week. Binance’s counter is scale: we are too big for even this to matter.

The numbers deserve a second read, in the other direction. Of the $6.34 billion taken, about $2.85 billion has been frozen or intercepted — which means roughly $3.5 billion has not. The 98% replenished leaves the hardest 2%, the thinly traded tokens, still being bought. Binance says it blocked 57 suspected North Korean attempts this year, which tells you the attempts are constant, closer to weather than to war. And the detail the report’s framing glides past: the security team caught the June attempt, did everything right, and the campaign succeeded anyway, five months later, through the front door.

The honest counterweight: this is Binance’s account, published by Binance, and independent security firms have been engaged but have not yet verified it. The full technical post-mortem is still pending. One step in the chain is simply unexplained — how an internal AI tool carried the attackers from one engineer’s computer to two others. North Korea denies the FBI’s attribution. Security researcher Marcus Hutchins gave the short version: for all the machinery involved, this was phishing — a fake-recruiter campaign of the kind North Korea has run against crypto and finance employees for years.

Winners:

TraderTraitor — $6.34 billion taken for the cost of a staged hiring process; roughly $3.5 billion of it still unfrozen
Rival exchanges — every competitor selling caution and custody gets its best advertisement of the year, written by Binance
Human-layer security — the next security budgets will be spent on hiring processes, download habits, and verification, not only on code audits

Losers:

Binance — the largest theft in crypto history, executed through its own signing service; the reimbursement was flawless and the breach still happened
The “unhackable” business model — no code was broken anywhere in this chain; three work laptops were the entire attack surface
Job platforms and recruiters — a legitimate hiring process is now a documented way into a company’s most guarded systems, and every platform’s trust is worth a little less

⚡ Spark Takeaway: Binance published the most embarrassing version of its own hack because the alternative — letting it leak — was worse, and because it could afford to. The exchange’s moat was never its code. It is a balance sheet big enough to refund $6.3 billion and a story told fast enough to survive it. What neither protects is the next engineer who gets a friendly interview invitation.

Sources: Binance initial incident report and media briefing, November 3, 2026 (co-CEO Richard Teng; chief security officer Jimmy Su), as reported by CoinDesk, SecurityWeek, and PYMNTS; FBI attribution as reported by Reuters.