Binance (BNB) $6.3B Hack Began With a Fake Job Interview, Report Says

By Nodora News · 4 November 2026

Binance says its $6.3B hack began with a fake job interview that infected an engineer's laptop, opening a months-long path to its hot wallet signing systems.

Binance, the exchange behind the BNB Chain token (BNB), says the record $6.3 billion hack that hit it on October 29 started months earlier with a fake job interview. In an initial incident report and media briefing on Tuesday, November 3, 2026, the exchange said North Korea-linked attackers infected an engineer's work laptop with a booby-trapped coding test, then spent weeks moving through internal systems before taking control of a hot wallet and draining funds.

Key takeaways

• Binance says the breach began in September, when an engineer was approached through a legitimate job platform and asked to download a "coding assignment" that carried previously unknown malware.
• An earlier June incident, a tampered Homebrew software package installed while an engineer looked for an AI coding tool, had already exposed details about Binance's wallet team.
• On October 20, attackers used the infected laptop and an internal AI tool to reach two wallet engineers' machines, then launched the theft on October 29 at 20:05 UTC.
• The attackers used Ethereum's EIP-7702 feature to gain execution rights over a hot wallet, and containment took about four hours.
• Binance says about $2.85 billion has been frozen, roughly 98% of affected tokens have been replenished with company funds, and users will not be affected.

How the Binance hack started: a fake recruiter and a coding test

According to Binance chief security officer Jimmy Su, a software engineer was contacted in September through a genuine job platform by someone posing as a project director. A fake HR representative then interviewed him over video and even shared a social media account with personal photos to make the approach feel real.

A second interview, this time with someone presenting as a CEO, ended with a request to download a coding assignment onto his work computer. That file contained zero-day malware, meaning malicious code that exploits a weakness security vendors did not yet know about, and it slipped past Binance's endpoint protection.

This tactic is not new. Fake recruiters and poisoned "take-home tests" are a long-running pattern in North Korea-linked campaigns against crypto companies. What stands out here is how patient the attackers were and how far one infected laptop carried them.

A months-long campaign inside Binance's systems

Binance co-CEO Richard Teng described the attack as "a campaign, built over many months" rather than a single slip. The report lays out a timeline that runs back to June:

• June: a Wallet DevOps engineer installed a tampered Homebrew package (Homebrew is a popular tool for installing developer software on Macs) while trying to set up an AI coding tool. Binance caught it, replaced the device and rotated credentials, but the incident exposed information about the engineer's role and colleagues.
• September: the fake job interview compromised a second employee's work computer.
• October 20: using that machine and an internal AI tool, the attackers reached the computers of two wallet engineers and found a container deployment permission on one of them.
• October 29: with stolen credentials, they deployed a container and ran a malicious script. Funds began leaving at 20:05 UTC.
• October 30: containment was completed at 00:10 UTC.

The final step relied on EIP-7702, an Ethereum feature that lets a regular wallet temporarily delegate its behaviour to smart contract code. Su said the attackers used it to set up malicious execution rights over a Binance hot wallet, which let them move funds outside the normal withdrawal process. Because the hot wallet is secured with multiparty computation (MPC), where signing power is split across several parties, no single key could quickly revoke that access, which is why it took around four hours to shut down.

What Binance says it has recovered and fixed

Binance says roughly $2.85 billion of the stolen assets has been frozen or intercepted, with help from stablecoin issuers and law enforcement, and that it has replenished about 98% of affected tokens with company funds. Teng told reporters that users will not bear the loss.

The exchange says it has closed the entry points used in the attack, rebuilt or replaced affected systems, tightened device controls and expanded AI-based behaviour monitoring. It is also bringing in independent cybersecurity experts to review the incident. Binance added that it detected and blocked 57 suspected North Korea-linked attempts during 2026, many using the same mix of fake interviews, malicious developer tools and social engineering.

The FBI has attributed the attack to North Korea. Pyongyang has rejected that claim, with Kim Jong-un's sister calling it a "grave political provocation" on Monday. For background on the original theft, see Nodora's coverage in Binance Hit by Record $6.3 Billion Hack Linked to North Korea.

Why the Binance incident report matters for crypto security

The report shifts attention from smart contract bugs to people and laptops. The weak point was not Binance's cryptography but ordinary developer workflows: job hunting, installing tools and running code on a work machine. Founder Changpeng "CZ" Zhao, who no longer runs the exchange, told CoinDesk he expects more attacks as AI tools help hackers, and argued that "the industry needs to use AI to prevent AI hacks." CoinDesk noted that Zhao offered no evidence of AI being used in the breach itself, and blockchain analytics firm Elliptic said the laundering appeared to follow automated scripts rather than decisions by AI agents.

For other exchanges, the lessons are practical: lock down what software engineers can install, limit who can deploy to production, and treat unsolicited recruiter contact as a real security risk.

BNB price and market reaction

The disclosure landed on a calm market. Withdrawals have been reopening in phases since November 3, and Binance has reported hourly deposits running ahead of withdrawals, as covered in Binance (BNB) Net Inflows Turn Positive at $2.3B After Record Hack. Prices from OKX at the time of writing:

• BNB: about $701.30, down 0.4% over 24 hours
• Bitcoin (BTC): about $77,640, down 0.3%
• Ether (ETH): about $2,298, up 0.5%

You can follow these moves on the Nodora charts page.

What to watch next

• The independent review: Binance has promised outside experts will examine the breach, and a fuller final report may follow.
• Frozen funds: whether more of the stolen assets are frozen or returned beyond the roughly $2.85 billion figure.
• Withdrawal restoration: how quickly the remaining assets reopen for withdrawal and whether net flows stay positive.
• Industry response: CZ says talks are underway on shared security standards or an industry alliance, though nothing has been agreed yet.

This article is for information only and is not financial advice.

#Binance #BNB #Hack #Security #North Korea

This article is general information, not financial advice.