Skip to main content
CadNews - Comparative News Analysis
Topics
Sign in
Back to brief

Crypto · November 3, 2026

Binance's $6.3 billion hack began with a fake job interview, exchange says

3 sources →

FreeGet stories like this compared, every morning at 7.

The incident resulted in a nearly three-day suspension of withdrawals. During this period, rival exchanges Bybit, Bitget, and OKX recorded significant increases in crypto deposit activity, though data does not definitively confirm if these inflows were direct migrations from Binance customers. Binance co-CEO Richard Teng stated the exchange remains in 'very strong financial health' and is preparing a post-mortem report. Preliminary findings suggest the breach was executed by North Korea-linked actors who compromised internal systems over several months after initiating contact through a fake job interview, eventually exploiting Ethereum's EIP-7702 mechanism.

Read the original coverage

Hype check

How the hype check works

Confirmed · 1

Backed by filings, on-chain data, official statements or several independent publishers.

  • Binance suspended withdrawals following the hack (Binance)

Claimed · 3

Said by a company, project or person; not yet independently confirmed.

  • Binance is in 'very strong financial health' (Richard Teng)
  • The hack was carried out by North Korea-linked attackers (Binance)
  • The breach began with a fake job interview (Binance)

Speculation · 1

Price talk, forecasts or unnamed sources, quoted as someone else's view.

  • The surge in rival deposits raises questions about lasting market-share gains (CryptoSlate)

Reported by multiple outlets

  • Binance was hacked on Oct. 29
  • Binance suspended withdrawals for nearly three days following the hack

Reported by only some outlets

  • Bybit's Ethereum depositing addresses increased 142% to 31,539 between Oct. 29 and Nov. 1
  • Bitget's TRON depositing addresses rose 130% to 10,274
  • Binance co-CEO Richard Teng says the exchange is in very strong financial health
  • The hack began with a fake job interview targeting employees
  • Attackers are linked to North Korea
  • The exploit involved Ethereum's EIP-7702 mechanism

FreeDaily Brief newsletter

Get the 5-minute Daily Brief, with the topics you pick.

The Daily Brief is free

About these outlets

CadNews does not determine absolute truth or endorse political viewpoints. It compares publicly available reporting, identifies shared facts, highlights framing differences, and flags uncertainty.