Binance says fake job scam led to $6.3 billion theft

Binance says North Korean hackers used fake recruiter profiles, interviews and malware to breach employee devices and force a withdrawal freeze.

Binance says North Korean hackers used fake social media profiles and a staged job offer to target one of its employees in a months-long attack that ended in the theft of $6.3 billion in crypto. In an updated statement posted on X on Tuesday, the company said the breach forced it to suspend customer withdrawals across its network. The case stands out not just for the scale of the theft, but because it relied on tactics security researchers have been warning about for years. According to IT-PUB News, Binance described the operation as a prolonged social engineering campaign aimed at its wallet team.

The attack used a method that is familiar, but still effective: exploiting trust, curiosity and routine work tasks to get inside a company’s systems. In Binance’s account, the hackers posed as recruiters and contacted a software engineer who works on wallets at the exchange. After two interviews with the supposed company, the engineer was told to download a coding assignment as part of the hiring process. The file contained malicious code and compromised the engineer’s work laptop.

A fake hiring process opened the door

Binance said its security tools did not detect the malware when the file was opened. Once inside, the attackers gained a foothold in the company’s network. From there, they were able to use an internal tool that could take over the work computers of two other engineers on the wallet team.

The company’s description shows how one infected laptop can become a gateway to a much wider breach. One of those engineers had earlier downloaded a tampered app containing password-stealing malware after finding the software in search engine results. Binance later replaced that laptop, but the hackers were still able to use the engineer’s stolen credentials to get into the computer of a third engineer.

That third engineer’s role gave the attackers access to systems capable of controlling billions of dollars in crypto. Binance said the attack “should not have happened” and said it had improved its network security after the theft.

Binance says the breach reached far beyond one employee

The heist is now the largest theft of crypto in history, which is one reason it has drawn such broad attention. The FBI and blockchain investigators have blamed North Korea for the attack. The country has long been accused of carrying out large cryptocurrency thefts, with the money allegedly used to support its internationally sanctioned nuclear weapons program.

Binance’s statement adds another layer. The company said it had faced at least 57 suspected attacks from North Korea. It described those incidents as part of the “persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.”

The scale of the loss makes the breach important beyond Binance itself. The company had to suspend withdrawals, directly affecting customers, while the incident also raises questions about how exchanges protect the systems that hold and move digital assets. In this case, the attack did not rely on a technical flaw alone. It combined deception, malware and access to employee devices.

The method was familiar, but it still succeeded

Researchers have repeatedly warned that North Korean hackers run long social engineering campaigns that can stretch over months. The source says these attacks are well known in the crypto industry and have been the subject of repeated warnings from the U.S. government and cybersecurity companies in recent years.

The methods described by Binance match that pattern. Hackers allegedly posed as venture capitalists, investors and recruiters, sometimes using dossiers of stolen American identities to make their approach more convincing. The goal is to persuade employees to hand over access, open malicious files or otherwise create a path into internal systems.

The source also says that some half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. That helps explain the intense scrutiny around the Binance case: even well-known warning signs did not stop a patient, targeted campaign.

Investigators are likely to examine Binance’s defenses

A key question now is how the hackers got the engineer to open malware despite the public warnings about this kind of attack. Another is how they were able to move through Binance’s network after the initial compromise.

The source says investigators are likely to focus on both issues. It also points to a broader problem: even when social engineering is the entry point, companies are still responsible for making sure their systems cannot run unauthorized or untrusted software that could lead to a breach.

Binance said it would bring in cybersecurity experts to review the incident and had already put new security measures in place to prevent a repeat. A company spokesperson referred to Binance’s public statement and declined to answer questions on the record about how it prevents unauthorized or malicious code from running on employees’ laptops, or whether any outside cybersecurity audits had been done before the hack.

For the crypto industry, the case is another reminder that major breaches do not always begin with a direct attack on exchange infrastructure. Sometimes they start with a fake recruiter, a convincing interview and a file that looks safe enough to open.