A fake job interview opened the door to Binance’s $6.3 billion heist

On or about 29 October 2026, attackers stole more than $6 billion in digital assets from the cryptocurrency exchange Binance. Binance puts the figure at about $6.34 billion. Two days later the FBI named who it believes did it, and Binance’s own incident report shows the attack started not with a clever exploit but with a job offer.

What the FBI says

In an alert published on 31 October 2026, the FBI attributed the theft to North Korea, calling the activity “TraderTraitor”. Working with the US Secret Service and IRS Criminal Investigation, the FBI says the stolen funds were converted mainly into Ether and are expected to be laundered through decentralised finance and instant-swap services. It has asked exchanges, node operators, blockchain analytics firms and other crypto services to block transactions with the addresses involved.

How the attack worked, according to Binance

Binance published an incident report on 3 November. As reported by BleepingComputer, it describes these steps:

1. The approach (September). Someone posing as a project director at a made-up company contacted a Binance software engineer through a legitimate job-hunting site. His profile mentioned Binance, which is what made him a target.
2. Building trust. A fake recruiter set up two interviews: a live video call with a supposed HR representative, then a chat with someone claiming to be the CEO.
3. The coding test. The engineer was asked to download a coding assignment from an online code repository. It contained custom malware that antivirus didn’t detect.
4. Hijacking a developer tool. The malware replaced the pyenv program installed through Homebrew on his Mac with a version that quietly ran commands from the attackers’ server.
5. Moving sideways (by 20 October). From that laptop, and with the help of an internal AI tool, the attackers compromised two more employees on the wallet infrastructure team and stole their credentials and a container deployment token.
6. The theft (29 October). With those credentials they deployed a malicious script, reached the wallet signing service and moved the funds across several blockchains.

Binance said that as of 3 November about $2.85 billion had been frozen or intercepted, and that it has rebuilt the affected systems, replaced compromised devices, revoked the stolen credentials and brought in independent security firms. The tactics match North Korea’s known fake-recruiter campaigns against developers.

What developers should take from this

You don’t need to work at an exchange to be a target. Developers have access to source code, cloud consoles, deployment tokens and signing keys, and fake job offers are one of the most reliable ways to reach them. Some habits that would have broken this chain:

• Never run a take-home assignment on your work machine. Use a throwaway virtual machine, a cloud dev environment or at least a separate user account with no saved credentials.
• Read before you run. Look at package.json scripts (preinstall, postinstall), setup.py, Makefiles and anything under .vscode/ before installing dependencies or opening the project in an editor that auto-runs tasks.
• Be suspicious of urgency and odd channels. A “CEO interview” over a personal chat app, or pressure to finish an assignment today, are both warning signs.
• Watch your toolchain. The malware didn’t touch Binance’s code at first; it replaced a developer tool. Tools like pyenv, nvm and shell profiles (.zshrc, .bashrc) run constantly and are rarely checked. Check where they point with which pyenv and type pyenv, and keep an eye on changes to them.
• Keep production keys off laptops. Signing services and deployment tokens should need more than one compromised machine, with hardware keys, approvals and short-lived credentials.

Why this matters beyond crypto

The same playbook works against anyone whose laptop can reach something valuable: a SaaS company’s production database, an open-source project’s release keys or a game studio’s build servers. A theft measured in billions needed no zero-day. It needed one convincing interview and one git clone.

Sources

• FBI: North Korea responsible for $6 billion+ Binance attack (31 October 2026) (opens in a new tab)
• BleepingComputer: Binance says fake job interview led to $6.3 billion crypto heist (reporting Binance’s incident report) (opens in a new tab)