Binance hackers used fake job interviews in record heist

Binance Co-CEO Richard Teng in Hong Kong on Tuesday | REUTERS

Bloomberg

Nov 4, 2026

Binance Holdings Ltd. said Tuesday that the hackers behind a $6.3 billion heist used social engineering techniques including fake job interviews, as well as malicious software, in the most detailed report yet on how the incident unfolded.

Binance, which attributed the hack to North Korea, said the breach involved a “sophisticated, multi-stage campaign.” One of the company’s engineers was contacted through a job hunting platform by someone posing as a project director, the exchange said in the report published Tuesday. The employee was then interviewed by a person claiming to be the chief executive officer of a fictitious company over a social chat app, and asked to download an assignment containing a “malicious code repository.” This then set off a series of unauthorized activities, the report said.

“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance. The attackers “combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques.”

In a time of both misinformation and too much information,
quality journalism is more crucial than ever.
By subscribing, you can help us get the story right.

SUBSCRIBE NOW