Phony Interview: How a Job Scam Enabled the $6.3 Billion Binance Heist

A $6.3 billion theft from Binance was executed in roughly twenty minutes, but the intrusion relied on a months-long campaign of deception that began with a fake job interview. The exchange released an initial assessment on Tuesday detailing how the attack unfolded, attributing the breach to a North Korean state-sponsored unit identified by the FBI as TraderTraitor.

The hackers first probed Binance’s defenses in June. The exchange detected and blocked that initial attempt, but the interaction provided the attackers with valuable intelligence regarding the platform’s security architecture. This early reconnaissance allowed the group to refine its strategy for a second, more targeted operation later in the year.

In September, the attackers contacted a Binance engineer through a job-hunting platform. They posed as a project director from a fictitious company and arranged a first-round interview with a supposed human resources representative. During this call, the interviewer shared personal photos and videos along with social media accounts to establish credibility. Binance described the tactic as a sophisticated social engineering approach designed to build trust with the employee.

The final stage of the operation required the engineer to join a second interview with the alleged company CEO on a popular social chat application. While using his work laptop, the employee was asked to download an assignment as part of the recruitment process. The file contained malicious code that allowed the hackers to install their attack infrastructure. This foothold enabled them to move through the system and eventually drain over $6 billion in customer cryptocurrencies last week.

Binance stated that it has taken immediate steps to address the breach, including initiating an independent cybersecurity review to prevent similar incidents. The exchange reported on Monday that it had already replaced most of the stolen assets using its own funds. The company acknowledged the disruption to its users, partners, and the wider industry, noting that the breach should not have occurred.

The identification of TraderTraitor places the incident within a pattern of state-sponsored cybercrime targeting digital asset platforms. The FBI’s attribution links the financial loss to North Korean military interests, adding a geopolitical dimension to what was initially reported as a technical failure. The timeline confirms that the attackers operated with precision, leveraging human error to bypass technical safeguards.