Binance Hackers Used Fake Job Interviews to Steal $6.3 Billion

Binance says a months-long campaign that used a fake job interview and a tampered AI coding tool let hackers breach its wallet system and move out billions in crypto.

Binance says hackers stole $6.3 billion from the exchange by running a fake job interview on one of its engineers and slipping malware into a coding exercise. Binance co-CEO Richard Teng told CNBC the attackers spent months building their way in rather than exploiting one weak laptop. In June they set up a tampered version of a developer tool and got an engineer to install it. In September a second engineer went through what looked like a normal recruiting process, job interviews included, that ended in a coding exercise carrying hidden malware. From there the attackers moved through Binance's internal AI tools and reached the system that authorizes wallet transactions. The FBI has linked the attack to North Korean hackers tied to the TraderTraitor group, though Teng himself did not make that attribution directly.

A Job Interview Becomes a Security Hole

This is the part of the story that should worry anyone who hires or who is job hunting right now. The attackers did not need to break through a firewall. They posed as recruiters, ran a believable interview process, and handed over a coding exercise, something every engineering candidate expects and does without thinking twice. That exercise carried the malware. For the job market, this means hiring itself is now a point of attack, not just a cost center. Companies that run technical interviews with take-home exercises or live coding tests have to treat those exercises the way they would treat an email attachment from a stranger. For job seekers, it also means a real recruiter contact can now be weaponized against the company they are trying to join, which is going to make legitimate recruiters work harder to prove who they are.

What a $6.3 Billion Exchange Hack Does to Businesses That Touch Crypto

If your business accepts crypto payments, holds crypto on a balance sheet, or banks with a payment processor that routes through an exchange, this hack is a reminder that your exposure does not stop at your own systems. Binance said it has replenished 98% of the $6.34 billion in affected assets and pledged to cover customer losses, and partners including Tether, Circle and Ripple have reportedly frozen about $3 billion of the stolen funds. Coinbase blocked transfers to the compromised wallets and offered Binance direct help.

Brian Armstrong's post is a good example of how fast the industry moved to contain the damage, which is why the hit to crypto market confidence was sharp but short. A small business owner taking crypto payments should read that as: the ecosystem has gotten better at freezing stolen funds fast, but the underlying risk, that a platform you rely on can be breached through its own staff, has not gone away.

How This Looks From the Insurance Side

In insurance, this is exactly the kind of loss that shows up first in how carriers underwrite cyber and crime policies. A breach caused by social engineering, meaning a human being tricked into letting attackers in rather than a technical exploit, is treated differently than a straight hack under most cyber policies. Many policies draw a hard line between a social engineering loss and a computer fraud loss, and the dollar sublimits on social engineering coverage are often far smaller than the overall policy limit. Any business, not just crypto exchanges, that has an employee with authority to move money or approve access should check whether their cyber policy actually covers a loss that starts with a fake recruiter or a tampered software download, because that is a growing category of claim, not a one-off.

The Toll on Trust and Income

Two Binance employees were personally targeted and used as the way in, through no fault beyond doing their jobs the way anyone would. That is a livelihood cost that does not show up in the dollar figure: engineers now have to wonder whether the next recruiter email or coding test is real. Binance has restricted some withdrawals while it works through recovery, which hits anyone who had funds tied up on the platform and needed access to their own money. The company says it remains financially sound and is covering customer losses, which matters, but the temporary restriction is still a real disruption to people who count on that money.

What to Watch and What to Do

If you run a business with technical hiring, verify recruiters through a second channel before any candidate installs anything, and never let a coding exercise run with real credentials or on a machine that touches production systems. If your business holds or accepts crypto, do not keep more on any single exchange than you can afford to have temporarily frozen during an incident, and ask your insurance broker, point blank, whether your current cyber or crime policy covers a loss that starts with social engineering rather than a direct technical breach. And if you are job hunting in tech right now, confirm a recruiter's identity through the company's own career page or LinkedIn before opening any file they send, because this attack proves the interview process itself is now a target.