Binance Hack Traced to Malware Hidden in a Fake Job Interview
Binance's investigation into the roughly $6.3 billion theft reported at the end of October 2026 found the intrusion began with a sham hiring process.
1 source 2h ago
Reporting from 1 source: GIGAZINE.
Why it matters
The theft did not come from a broken wallet or a cracked key but from an engineer downloading an interview assignment, which puts hiring pipelines and developer tooling on the same threat surface as the exchange itself.
Key Facts
- Binance reported the theft of roughly $6.3 billion worth of cryptocurrency at the end of October 2026.
- An engineer was contacted on a legitimate job platform by someone claiming to be a project director and interviewed over video and a social chat app.
- The fake CEO told the engineer to download an assignment that contained malware executing during setup.
- In June 2026 an engineer downloaded a tampered Homebrew package while seeking an AI coding tool, exposing job-role and team information.
- Binance counted 57 cyberattack cases in 2026 suspected of links to North Korea.
An engineer was contacted on a legitimate job platform, interviewed by people posing as an HR representative and a CEO, and told to download an assignment that carried malware. A June 2026 supply chain incident and a tampered Homebrew package were part of the same wider campaign.
Binance's account splits the operation into stages rather than one breach. In June 2026 an engineer who built and ran crypto wallets searched for a popular AI coding tool and downloaded a tampered Homebrew package instead. Security staff caught the anomaly, swapped the PC and rotated credentials, but job-role and teammate information had already leaked.
The September 2026 stage moved to people. An engineer was approached on a legitimate job platform by someone claiming to be a project director, then sat a live video interview where a supposed HR representative shared personal photos and videos to build trust. A second interview on a social chat app ended with a request to download an assignment containing malicious code.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google