Fake jobs and malicious code used by hackers in largest crypto-heist

• Topic:Cyber Crime

Posted Wed 4 Nov 2026 at 2:28pmWed 4 Nov 2026 at 2:28pm

In short:

The crypto-exchange platform at the centre of a $9 billion cyber attack says hackers used job interviews and malicious code to steal the funds.

The company says the hackers appeared to take their first steps towards the breach as early as June.

What's next?

It says 98 per cent of the affected assets have been recovered by drawing on its own funds.

The world's largest crypto-exchange platform says attackers used fake job interviews and malicious code to steal $US6.6 billion ($9 billion) in funds.

The attack on Binance, believed to be the largest cyber attack in the cryptocurrency sector's history, caused the prices of most major cryptocurrencies to fall sharply.

The FBI has attributed the four-hour attack on October 29 to North Korea-affiliated hackers.

North Korea has denied the allegations, with the powerful sister of leader Kim Jong Un calling the claim "absurd rhetoric".

How it unfolded

Binance said the hackers began their plans as early as June.

It said they first targeted a platform engineer by getting them to download a virus-laden version of the widely known programming software Homebrew.

Binance's cybersecurity teams identified the malware and removed it, but the hackers had already had time to harvest information about the engineer and his colleagues.

In September, the attackers approached another Binance engineer through a legitimate job-search platform, offering him an interview for a position in a fictitious company.

After building trust with the subject through sharing social media photos and videos, they asked the engineer to download a test exercise as part of the interview process.

The exercise contained malware that deployed "sophisticated obfuscation and evasion techniques", Binance said, including replacing a legitimate development tool component with a malicious version.

That malware was critical to the success of the attack, as it allowed the hackers to establish a connection with Binance's internal systems.

On October 20, the attackers used the access they had gained and an internal AI tool to gain control over software used by two other engineers.

Nine days later, they triggered malicious code that initiated the attack.

According to Binance, 98 per cent of the affected assets have been replenished by drawing on its own funds, with the remaining amount involving little-traded currencies that are harder to acquire.

It said around one-third of the stolen assets had been frozen, meaning the attackers could not use them or convert them to another currency.

AFP