Skip to main content
Back to brief

Crypto · November 3, 2026

Binance says hackers used fake job interview to compromise computer before $6.3 billion attack

6 sources →

FreeGet stories like this compared, every morning at 7.

The attack reportedly involved social engineering tactics where hackers posed as recruiters on platforms like LinkedIn to conduct fake job interviews with engineers, eventually persuading one to download a malicious coding exercise. Additionally, a fraudulent advertisement for the 'Homebrew' software package was used to compromise another engineer's workstation. Once inside, the attackers reportedly exploited internal artificial intelligence tools to gain unauthorized access to the system responsible for authorizing wallet transactions. Binance co-CEO Richard Teng stated that the company has replenished 98% of the affected assets. Analysts and major outlets have attributed the breach to North Korean hackers, and South Korea's president has since called for a national 'cybersecurity czar' to address such threats.

Read the original coverage

Confirmed · 2

Backed by filings, on-chain data, official statements or several independent publishers.

  • Hackers used fake job interviews to target an engineer (Binance)
  • South Korea's president called for a cybersecurity czar (Lee Jae Myung)

Claimed · 3

Said by a company, project or person; not yet independently confirmed.

  • An internal AI tool was used to drain company wallets (Binance)
  • North Korean hackers were responsible for the attack (Binance executives)
  • 98% of assets have been replenished (Richard Teng)

Speculation · 2

Price talk, forecasts or unnamed sources, quoted as someone else's view.

  • The event could be the largest-ever financial theft (Reuters)
  • The heist is the 'biggest in crypto history' (Fortune)

Reported by multiple outlets

  • The attack involved a monthslong campaign using fake job interviews to compromise an engineer's computer.
  • Attackers exploited an internal artificial intelligence tool to facilitate the theft.
  • A Binance engineer was contacted via a job-hunting platform by individuals posing as recruiters.
  • The incident was disclosed in a report released by Binance on Tuesday.
  • The breach occurred on October 29.

Reported by only some outlets

  • CNBC and Fortune report that the campaign began as early as June with a fake version of a developer tool.
  • Fortune identifies LinkedIn as the specific job-hunting platform used.
  • Fortune and The Block attribute the attack to North Korea.
  • CoinDesk reports that South Korean President Lee Jae Myung called for a 'cybersecurity czar' following the hack.
  • Fortune reports the attackers used a malicious internet advertisement for a tampered version of 'Homebrew' software to target an engineer.

FreeDaily Brief newsletter

Get the 5-minute Daily Brief, with the topics you pick.

The Daily Brief is free

CadNews does not determine absolute truth or endorse political viewpoints. It compares publicly available reporting, identifies shared facts, highlights framing differences, and flags uncertainty.