A fake job interview and a malicious coding assignment helped hackers infiltrate Binance’s internal systems in a months-long cyberattack that resulted in the theft of $6.3 billion in digital assets, exposing how seemingly routine recruitment processes can become entry points for sophisticated attacks on cryptocurrency exchanges.
The world’s largest cryptocurrency exchange disclosed the details in a postmortem released on Tuesday, revealing how attackers targeted its employees, compromised their work devices and gradually obtained access to systems controlling its wallet infrastructure before the October 29 breach.
According to Binance, the operation began months before the theft, with hackers exploiting employees’ trust in software tools and recruitment processes to gain access to sensitive internal information and credentials.
The findings highlight the growing risks facing cryptocurrency companies, where a single compromised employee device can potentially expose critical infrastructure and undermine layers of digital security.
How hackers used a fake recruitment exercise to breach Binance
Binance said the campaign began in June when an engineer downloaded a tampered software package while setting up an artificial intelligence coding tool.
Although the exchange detected the malware and replaced the affected device, the attackers had already collected information about its wallet team.
The operation escalated in September when hackers posing as recruiters approached another software engineer and persuaded the employee to download a malicious file disguised as a coding assignment.
The file compromised the engineer’s work computer and reportedly evaded Binance’s security protections.
On October 20, the attackers leveraged the compromised computer and an internal artificial intelligence tool to gain access to the systems of two additional engineers, obtaining deployment credentials that eventually enabled them to install malicious software within Binance’s wallet infrastructure on October 29.
The attackers subsequently gained access to the exchange’s internal wallet-signing service, which authorises cryptocurrency transactions. This gave them the ability to move funds outside the normal withdrawal process.
“This wasn’t one mistake or one breach — it was a months-long campaign,” Binance co-CEO Richard Teng said in a Tuesday post on X.
Hackers exploited Ethereum wallet mechanism
Binance’s investigation also identified the exploitation of Ethereum’s EIP-7702 mechanism, which allows cryptocurrency wallets to delegate transaction permissions to smart contracts.
According to the exchange, the attackers used the mechanism to facilitate unauthorised transfers that continued even after Binance suspended withdrawals.
Its multiparty computation (MPC) wallet system, which distributes control over transaction signing, also complicated efforts to revoke the permissions granted to the attackers.
The breach affected approximately $6.3bn in digital assets, with Binance reporting that $2.85bn had been frozen or intercepted, according to its latest accounting.
The exchange said it would absorb the losses rather than transfer the financial burden to customers. It also reported that it had replenished 98 per cent of the affected token assets as of October 31.
The attack, described as the largest cryptocurrency hack in history, has been attributed to North Korean hackers by the Federal Bureau of Investigation.
However, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the country’s involvement on Tuesday, describing the FBI’s attribution as politically motivated and intended to damage North Korea’s international standing.
Binance says it blocked 57 suspected North Korean cyber threats
The scale of the breach has also raised questions about the effectiveness of security measures against persistent attacks targeting employees and internal systems.
Binance co-founder Yi He said the exchange’s security team had detected and prevented 57 suspected North Korea-linked cyber threats in 2026.
She said the attempts included fraudulent job interviews, malicious software packages and social engineering campaigns designed to steal credentials or install malware on employees’ devices.
“We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened,” she said.
The disclosure underscores the challenge facing cryptocurrency exchanges as hackers increasingly target employees and trusted workplace processes rather than relying solely on conventional attacks against digital infrastructure.
For Binance, the incident has demonstrated how a prolonged campaign involving social engineering, compromised devices and stolen credentials can bypass security measures and expose even sophisticated financial technology systems to significant losses.
