Binance's $6.3bn hack began with a fake job interview, it says
Why it matters
Binance says its $6.3bn hack began when an engineer ran a fake job test on his work laptop. For any firm holding client crypto, hiring scams and staff devices are now a front-line custody risk.
The short version
Binance said on 3 November that its $6.3bn hack was a months-long campaign that began with a fake job interview for one of its engineers. Attackers later reached wallet engineers' computers and drained a hot wallet on 29 October. About $2.85bn has been frozen, and Binance says users will not lose out.
Here's what happened. At a media briefing on Tuesday, Binance explained how attackers got in, CoinDesk reported. Chief executive Richard Teng called it a campaign built over many months and said the FBI has blamed North Korea.
According to security chief Jimmy Su, it started in September. An engineer was approached through a real job platform, interviewed by fake recruiters and asked to download a coding task onto his work computer. It carried malware his security software did not catch.
On 20 October the attackers used that machine, and an internal AI tool, to reach two wallet engineers' computers. On 29 October they used stolen logins to run a malicious script, and money began leaving a hot wallet (one kept online for fast withdrawals). Binance said it had contained the attack by early 30 October.
About $2.85bn has been frozen, Binance said, and it has topped up about 98% of the affected tokens with its own money. It says it blocked 57 suspected North Korean attempts this year and will bring in outside experts to review the breach.
So what's the lesson? The way in was not the wallet technology. It was people and their laptops.
Where this comes from
Written with AI from the sources above and checked against them before publishing. Here's how we work. This is news, not financial advice. Spotted a mistake? Tell us.