How a Fake Job Interview Helped Hackers Hit $6.34bn in Crypto

Imagine stopping 57 attempted break-ins, only to discover someone got through by pretending to offer an employee a job.

That’s more or less what Binance says happened to it this year. Its security team caught 57 suspected North Korea-linked threats in 2026. Then one campaign got through and touched $6.34 billion in crypto.

So, does stopping 57 threats mean a company is secure? Well, it tells us Binance was catching attacks. What it doesn’t tell us is what happens when one gets through. If you’re trusting an exchange with your money, that’s the question that matters.

And Binance’s own account of the breach gives us an answer.

How the Binance hack happened

In June, an engineer downloaded a tampered installer while setting up an AI coding tool. Binance says it detected the problem, replaced his laptop and reset credentials. But the attackers had already learned about his role and his colleagues on the wallet team.

That gave them their next target. In September, another engineer went through what looked like a normal job interview. He even spoke with someone posing as the fake company’s CEO. But the coding assignment he downloaded contained malware.

Then, on October 20, the attackers used an internal AI tool to take control of two wallet engineers, including the one targeted in June. By October 29, stolen access had got them into the system that authorizes crypto transfers.

Here’s the part I’d worry about if my money were on the platform: Binance hit the brakes, and the money kept moving anyway.