Binance Says $6.34 Billion Hack Began With Fake Job Interview

The $6.34 billion theft from Binance began with a fake job interview and ran for five months before a single coin moved, the exchange said Tuesday in its first public account of the Oct. 29 attack.

Another initial incident report from Binance, released alongside a media briefing by co-CEO Richard Teng and chief security officer Jimmy Su, describes a campaign that combined a poisoned software download, a staged recruitment process, malware that evaded endpoint detection and an internal AI tool the attackers turned against the company’s own wallet engineers. 

Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance being bought on the open market.

“This wasn’t one mistake or one breach — it was a months-long campaign,” Teng wrote on X. “We’re publishing the full report because the lessons go far beyond Binance.”

The FBI has attributed the attack to North Korea. Binance’s report cites that finding but stops short of its own attribution. Pyongyang rejected the claim Monday, with Kim Yo Jong, sister of leader Kim Jong Un, calling it a “grave political provocation” through state media.

The Binance hack had five months of preparation