Crypto: Binance hack began with a fake job interview
A fake job interview allowed hackers to infect a Binance engineer’s computer before the October 29, 2026 theft of $6.34 billion. In its report published on November 3, the crypto exchange describes an infiltration prepared over several months, involving malware, stolen credentials, and misuse of an internal artificial intelligence tool.
An engineer downloaded an infected coding exercise after two fake interviews.
The attackers used an internal AI tool and stolen deployment credentials.
Binance says it has replenished 98% of the affected assets and blocked or intercepted $2.85 billion.
A fake job offer enabled the infiltration of Binance
The investigation reveals an operation that lasted much longer than initially thought. Following the Binance hack linked to North Korean hackers, the platform reconstructed a sequence of events that began in June 2026, four months before the theft.
An engineer responsible for wallet operations downloaded a modified Homebrew installer while looking for an AI-assisted coding tool.
Homebrew is a package manager commonly used by macOS and Linux developers.
Binance detected the anomaly, replaced the employee’s computer, and renewed the affected credentials. However, the hackers had already obtained information about the employee’s role and colleagues.
A second operation began in September.
Another engineer received a job offer through a legitimate recruitment platform. The supposed recruiter introduced himself as a project manager at a company.
$BNB
$LINK
$MACI.US
#hakeo
A fake job interview allowed hackers to infect a Binance engineer’s computer before the October 29, 2026 theft of $6.34 billion. In its report published on November 3, the crypto exchange describes an infiltration prepared over several months, involving malware, stolen credentials, and misuse of an internal artificial intelligence tool.
An engineer downloaded an infected coding exercise after two fake interviews.
The attackers used an internal AI tool and stolen deployment credentials.
Binance says it has replenished 98% of the affected assets and blocked or intercepted $2.85 billion.
A fake job offer enabled the infiltration of Binance
The investigation reveals an operation that lasted much longer than initially thought. Following the Binance hack linked to North Korean hackers, the platform reconstructed a sequence of events that began in June 2026, four months before the theft.
An engineer responsible for wallet operations downloaded a modified Homebrew installer while looking for an AI-assisted coding tool.
Homebrew is a package manager commonly used by macOS and Linux developers.
Binance detected the anomaly, replaced the employee’s computer, and renewed the affected credentials. However, the hackers had already obtained information about the employee’s role and colleagues.
A second operation began in September.
Another engineer received a job offer through a legitimate recruitment platform. The supposed recruiter introduced himself as a project manager at a company.
$BNB
$LINK
$MACI.US
#hakeo
