Binance hackers used fake job interview in $6.3b attack

PARIS/ DETROIT:

Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third's computer to drain $6.3 billion worth of crypto in last week's record heist, the exchange said on Tuesday.

In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multi-stage hacking endeavour that began in June and set off a series of security breaches culminating in the theft on Thursday.

Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Thursday, the hackers were still making off with crypto from the exchange nearly four hours after the first theft, Binance said.

The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers whose funds were stolen.

The attack has raised questions about how hackers breached the world's largest crypto exchange after years of North Korea-linked attacks, which have grown in ambition and frequency, and renewed questions about the vulnerability of digital assets to cybercrime.

Cybersecurity experts and government officials have for years warned about North Korean and other hackers using phony job interviews to target employees at companies of interest, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Fake job interviews are a well-known hacking technique.

Binance said it had detected and prevented 57 suspected North Korea-linked cyberthreats in 2026. That shows Binance is "just getting barraged," Barnhart said.