# Binance Reveals Hackers Used Fake Job Interviews in $6B Heist Attackers utilized sophisticated malware and social engineering to breach Binance's internal systems. - **Source:** [Newstalk ZB](https://www.newstalkzb.co.nz) - **Published:** 2026-11-04 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/e4237d6f-a5a5-48cf-8ca6-ae6ad9ec9508 ## Massive Cryptocurrency Heist Binance recently confirmed a massive security breach resulting in the theft of US$6 billion in assets. The attack occurred on October 29 and lasted approximately four hours. As the world's largest crypto exchange by trading volume, the incident triggered a sharp decline in the prices of most major cryptocurrencies globally. ## Sophisticated Social Engineering Hackers initiated their campaign as early as June by targeting a platform engineer. They tricked the employee into downloading a virus-laden version of the Homebrew programming software. Although cybersecurity teams initially removed the malware, the attackers successfully harvested critical information about the engineer and his colleagues during the initial exposure. ## Fake Interview Strategy In September, attackers contacted another engineer through a legitimate job-search platform, offering a position at a fictitious company. They built trust by sharing social media content before requesting the engineer download a test exercise. This file contained malware that replaced a legitimate development tool component with a malicious version. ## Internal System Compromise The malicious code allowed hackers to establish a persistent connection with Binance's internal systems. By October 20, the attackers leveraged this access alongside an internal artificial intelligence tool to gain control over software used by two additional engineers. This strategic infiltration provided the necessary permissions to execute the final theft. ## Attribution and Denial The United States Federal Bureau of Investigation attributed the attack to hackers affiliated with North Korea. Pyongyang has officially denied these allegations, with the sister of leader Kim Jong Un dismissing the claims as absurd rhetoric. The investigation highlights the increasing complexity of state-sponsored cyber threats targeting global financial infrastructure. ## Asset Recovery Efforts Binance has replenished 98% of the affected assets by drawing on its own corporate funds. The remaining stolen amount involves illiquid, little-traded currencies that are difficult to acquire. Additionally, the exchange confirmed that approximately US$2.85 billion of the stolen funds have been successfully frozen, preventing the attackers from converting them. ## Cybersecurity Evasion Techniques The malware deployed during the attack utilized sophisticated obfuscation and evasion techniques to bypass standard security protocols. By mimicking legitimate development tools, the attackers remained undetected while navigating internal networks. This incident underscores the vulnerability of high-profile tech firms to targeted, long-term social engineering tactics aimed at their engineering staff. ## Broader Market Implications This heist represents the largest cryptocurrency theft in history, raising significant concerns regarding platform security. The event caused immediate market volatility, reflecting investor anxiety over the safety of digital assets. Moving forward, exchanges must enhance verification processes for external software and implement stricter controls for employee interactions with third-party platforms. ## Sources covering this story - https://www.newstalkzb.co.nz/news/business/binance-reveals-hackers-used-fake-job-interviews-malicious-code-in-us-6b-heist/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._