Binance Links Fake Job Interview to $6.34 Billion Security Incident

Binance’s preliminary findings link a fake job interview to the Oct. 29 compromise of systems used to sign wallets, an incident that affected about $6.34 billion in virtual assets.

In September, an engineer interviewed for a role at a fictitious company and received a coding assignment that installed malware on the engineer’s work computer. On Oct. 20, attackers used that computer and an internal AI tool to access two other engineers’ computers. Nine days later, they used stolen credentials and a container deployment token to reach wallet-signing systems, bypassing the exchange’s normal withdrawal process.

Binance counted 57 suspected North Korea-linked cyberthreats detected and prevented in 2026. It did not say how many involved fake interviews or whether any were connected to the October breach.

The exchange estimated that $2.85 billion had been frozen or intercepted as of Nov. 3 and said 98% of affected token assets had been replenished. The figures are subject to reconciliation and do not establish a final net-loss total. Binance’s investigation is ongoing, with further independent review planned.