Binance hack: how a fake job interview led to the largest crypto theft in history ($6.3 billion)

What we know about the $6.3 billion Binance theft: the attack chain step by step, the response and the security lessons you can apply.

On October 29, 2026, Binance suffered the largest cryptocurrency theft in history: around $6.3 billion left its wallets in a matter of minutes. That is more than four times the previous record, the $1.5 billion Bybit hack in 2025. And the most striking part isn't the number, it's how it all started: with a fake job interview.

This article sums up what is known so far (sources at the end), walks through the attack chain step by step and, above all, pulls out practical lessons for anyone who works, or wants to work, in cybersecurity.

What happened: the 30-second version

When: October 29, 2026; transfers started on several blockchains at once between 20:05 and 20:20 UTC.
How much: about $6.3 billion across ten blockchains.
Who: the FBI and blockchain intelligence firm TRM Labs attribute it to North Korean hackers; European authorities name the TraderTraitor group, linked to Lazarus. North Korea denies it.
How: a Binance engineer ran a malware-laced "coding test" during a fake hiring process. From that laptop, the attackers worked their way to the service that signs wallet transactions.
Users: Binance says it is covering the losses: "Binance will absorb the financial impact of these stolen funds, not our users." Withdrawals resumed on November 1.

The attack chain, step by step

Based on Binance's own account (as reported by BleepingComputer and NBC News), the attack was weeks in the making:

1. The lure: a job offer (September)

A Binance software engineer was approached on a legitimate job platform by someone posing as a project director. There were two interviews: the first with a supposed HR person, on a video call and using photos taken from social media to build trust; the second, over chat, with someone claiming to be the company's CEO.

2. The "coding assignment"

In the second interview the engineer was asked to download a programming exercise from a code repository. It contained hidden malware. Binance says it used obfuscation and evasion techniques, including swapping a legitimate developer-tool component for a malicious one: on macOS it created an executable named pyenv_ in Homebrew's directories, deleted the real pyenv and used it to spawn a Z shell for remote command execution. It was previously unknown malware and the laptop's security tools did not catch it.

3. Lateral movement (by October 20)

From the compromised laptop, and with the help of an internal AI tool, the attackers obtained credentials and a container deployment token from two more employees working on wallet infrastructure. Binance co-CEO Richard Teng has stressed that this was "a more complex process rather than the misuse of a single engineer's permissions".

4. The heist (October 29)

With those credentials they deployed a malicious script that gave them access to the wallet signing service, the component that authorizes funds to leave. They drained assets from ten blockchains in roughly 20 minutes, including at least one transaction worth more than $2.5 billion. According to Binance, they also abused Ethereum's EIP-7702 authorization mechanism (which lets a regular account delegate execution to contract code) to keep moving funds even after withdrawals had been suspended.

How much was stolen, and from where

Blockchain	Approximate value stolen
Ethereum	$3.8 billion
Bitcoin (18,270 BTC)	$1.5 billion
TRON	$628 million
XRP	$296 million
Solana	$96 million
Arbitrum, Optimism and Base	$39 million
Avalanche	$28 million
Polygon	$10 million

Elliptic, another blockchain analytics firm, called it almost certainly the largest known theft of any kind, not just of crypto.

The response: freezes, emergency funds and a bank run

This part of the story shows how different stealing on-chain is from robbing a bank:

Stablecoins can be frozen. Tether and Circle (issuers of USDT and USDC) froze the attacker's wallets on October 30, three minutes apart. Estimates of the frozen amount range from about $2.7 billion (TRM Labs) to about $3 billion (Binance).
Bitcoin can't. The $1.5 billion in BTC cannot be frozen; it can only be traced and flagged to the exchanges where the attackers try to cash out.
Binance dipped into its reserves. It used its SAFU fund (Secure Asset Fund for Users), part of its futures insurance fund and its corporate treasury. On October 31 it said it had restored backing for roughly 90% of affected assets, with BTC, ETH, USDT, BNB, SOL, USDC and XRP backed 100%.
Mass withdrawals. When withdrawals reopened on November 1, users pulled out $4.65 billion in nine hours. By the next morning net outflows were around $4.9 billion, about 3% of the exchange's total assets.

The FBI has published wallet addresses tied to the theft and the US Secret Service is working to trace and recover the funds. Laundering a haul this size takes time: analysts say turning it into usable money can take weeks to years and requires middlemen.

Practical lessons (especially if you are job hunting in tech)

This wasn't an exotic cryptographic flaw, it was well-executed social engineering. Fake job offers aimed at developers are a tactic North Korean groups have used for years. Here's what you can apply today:

If you're given a coding test

Never run take-home code on your work machine. Ideally not on your personal one either: use a disposable VM or container with no access to your credentials, SSH keys or wallets.
Read before you run. Check install scripts (package.json with postinstall, setup.py, Makefile, git hooks) and odd dependencies or look-alike package names.
Verify the recruiter. Confirm the person exists and works where they claim, through a different channel from the one they used. Be wary of urgency and of "CEOs" interviewing over chat.

If you build or defend infrastructure

Isolate what's critical. The service that signs transactions (or deploys to production) shouldn't be reachable with credentials from a developer laptop.
Least privilege and short-lived tokens. A stolen deployment token shouldn't stay valid for weeks.
Multiple human approvals for large operations and amount limits: a $2.5 billion transfer should trip every alarm before it executes.
Behavior-based detection, not just signatures. This malware was new and the antivirus missed it, but a replaced pyenv binary or an unexpected shell spawned by a developer tool are detectable signals.

If you want to dig into the technical side, our site has guides to build the basics: Linux commands for ethical hacking (to know what to look for on a compromised system), forensics tools like Volatility and a smart contract security section. And if you are starting from zero, the Hackers en Acción academy is about to open.

Sources

Updated November 4, 2026. The investigation is ongoing and some figures may change.