Fast Facts
- Binance says a sophisticated, multi-stage cyberattack stole $6.43 billion, using compromised software and social engineering.
- Fake job interviews tricked engineers into installing malware, which attackers used to compromise devices, credentials and internal AI tools.
- Stolen access let attackers bypass normal withdrawal procedures through Binance’s wallet-signing service.
- Binance rebuilt affected systems and tightened security; Chainalysis says similar interview scams point to a wider North Korea-linked campaign.
A multistage attack
Binance says attackers stole $6.43 billion in assets through a planned, multistage campaign—not a single phishing email. The company traced the first step to June 2026, when one engineer downloaded a tampered Homebrew installer while seeking an AI tool. The installer exposed information about the engineer’s role and colleagues, Binance said.
In September, attackers posed as recruiters and invited another engineer to two online interviews. Near the end of the process, they asked the engineer to download a coding assignment onto a work computer. Its setup process ran malicious code, giving the attackers a foothold.
By October, the intruders had compromised employee devices and misused an internal AI tool to expand their access, according to Binance. They then used stolen credentials and a deployment token to reach an internal wallet-signing service. That access let them initiate transactions outside the usual withdrawal process.
Security lessons and response
Binance says it replaced affected devices, revoked related credentials, rebuilt the wallet system and internal AI tool, and tightened access controls. It also expanded monitoring for unusual behavior and worked with law enforcement and industry partners to trace and freeze assets.
The case shows how ordinary workplace routines—installing software or applying for a job—can become security risks when attackers exploit trust. At the same time, AI tools can support useful work, but companies need to limit their access and monitor how people use them.
Blockchain analysis firm Chainalysis linked more than $14.3 million in losses over the previous 18 months to similar fake-interview schemes. It says smaller attacks helped suspected North Korean actors refine their methods. Binance also said it had stopped 57 suspected North Korea-linked cyber cases since the start of 2026.
Stay Ahead with the Latest Tech Trends
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
