Verified Evidence: resolved · Fact Lock: locked · QA: pass
Binance disclosed on 3 November 2026 that it had been compromised in a multistage cyberattack involving malware and a fake job interview, with attackers taking approximately $6.3 billion in cryptocurrency.

The company’s account describes an operation that developed over several months rather than a single intrusion. Preparation began in June 2026 after a Binance developer inadvertently downloaded malware or used a tampered installer, according to the postmortem details reported by The Guardian Business, The Verge and ANSA.

The campaign later moved into recruitment fraud. A Binance engineer was contacted through a legitimate job-hunting platform and invited to interviews with people posing as representatives of a nonexistent company. The mechanism was reported by BBC News and corroborated by several other outlets covering Binance’s disclosure.

The reported toolkit included malicious software, fake social-media profiles and an internal AI tool. The available evidence confirms that these elements were part of the campaign, but does not fully establish how each one was used. The operation ultimately reached Binance hot wallets, from which approximately $6.3 billion worth of crypto-assets was removed.

The suspected identity of the attackers remains a separately attributed assessment. The Hill reported that the FBI and outside analysts had linked them to North Korea, while HCAMag characterized them as North Korean hackers. The supplied material does not present that attribution as an independently confirmed finding by Binance.

The reports establish the broad sequence—from an initial malware-related compromise to a fake-interview operation and the later wallet theft—but leave some details unresolved. They do not specify the precise date of the theft or its physical location, and they do not identify the engineer or the people behind the false recruiting profiles.

SOURCES

  1. The Guardian BusinessHackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’
  2. The HillBinance says malicious code, fake job interview led to $6.3B hack
  3. Financial TimesBinance hackers used fake interviews and social media profiles in $6.3bn heist
  4. The VergeBinance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist
  5. BBC NewsBinance says fake job interviews used as part of $6.3bn crypto hack