Binance Traces $6.43 Billion Theft to Fake Job Interviews and Trojanized Software
Binance says the attacker reached its wallet signing service through staff compromise, and the company is rebuilding affected systems while working with law enforcement to freeze assets.
Binance said a $6.43 billion theft from its platform was a multi-stage intrusion beginning in June 2026, when an engineer on its Wallet DevOps team installed a trojanized Homebrew package while looking for an AI tool. A second engineer was later targeted in September 2026 through a fake recruitment process run by someone posing as a Project Director, which ended with an assignment containing malicious code. On October 20 the attacker used that machine and an internal AI tool to reach two more engineers, and on October 29 deployed a container that exploited access to an internal wallet signing service to send transactions outside the normal withdrawal process. Binance says it has rebuilt the affected wallet system and internal tools, replaced devices, revoked credentials, and is working with law enforcement to trace and freeze the assets. The company also reported 57 suspected North Korea-linked threat cases foiled so far this year, a sign of how persistent these attacks on crypto firms have become.
Why it matters
The case shows that a theft of this size can start with ordinary tools and hiring channels rather than a direct break into exchange infrastructure. For users and other crypto firms, it highlights that the weakest point can be an employee's device or a recruitment process, not the platform's code. Binance's account also places the attack within a wider pattern, with 57 suspected North Korea-linked threat cases it reports having foiled this year.
Series Binance crypto theft breach
- Binance Traces $6.43 Billion Theft to Fake Job Interviews and Trojanized Software
- Binance resumes withdrawals after $6.3 billion breach, says 95% of stolen assets are covered
- FBI Links North Korea-Aligned TraderTraitor to $6.43 Billion Binance Crypto Theft
- Binance halts withdrawals after breach touching about $6.3 billion in crypto
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.