North Korean Hackers Steal $6.3 Billion From Binance via Fake Interviews and Malware
Updated
Updated · Fortune · Nov 3
North Korean Hackers Steal $6.3 Billion From Binance via Fake Interviews and Malware
3 articles · Updated · Fortune · Nov 3
Summary
$6.3 billion was drained from Binance wallets over several hours on Thursday after North Korean hackers compromised multiple engineers, in what the exchange called the biggest crypto theft on record.
Binance said the breach began with LinkedIn outreach and staged job interviews that tricked one engineer into downloading a malicious “assignment,” while a separate internet ad pushed another engineer to install a tampered Homebrew package.
That combination exposed wallet-management roles and let the attackers use a compromised laptop and Binance’s internal AI tools to seize more accounts, including one holding a container deployment token.
Binance said it had already blocked 57 North Korea-linked hacking attempts in 2026, underscoring how fake recruiter campaigns have spread beyond crypto across the corporate sector.
The exchange has recovered about $2.5 billion after Tether and Circle froze stolen stablecoins, restored withdrawals after a 48-hour pause, and says 98% of customer funds have been replenished.
How did North Korean hackers weaponize Binance's own internal AI to pull off history's largest $6.3 billion crypto heist?
If state actors can steal billions using fake LinkedIn interviews, are any crypto exchange employees truly safe from social engineering?
Could the rapid freezing of $2.67 billion in stolen stablecoins prove that decentralized crypto is actually controlled by centralized entities?
The $6.3B Binance Breach: How North Korean Hackers Pulled Off the Biggest Crypto Heist in History
Overview
The October 2026 Binance breach began when North Korean hackers gained access through a tampered software package and a fake job recruitment scheme, allowing them to plant malware and exploit Binance’s internal AI tools. Using stolen credentials, they launched an attack that drained over $6.3 billion from Binance hot wallets across 10 blockchains in just 20 minutes. The attack triggered global market panic and forced Binance to freeze all transactions. Emergency actions by Binance, asset issuers, and law enforcement helped freeze or recover nearly half the stolen funds. The breach led to official U.S. government attribution to North Korea and sparked worldwide regulatory and security reforms across the crypto industry.