ABRAnews Three sides to every story.
World

Binance says hackers used fake job interviews to steal $6.3 billion

Binance cites an FBI finding that North Korea is responsible, but Pyongyang denies any involvement in the record crypto theft.

6 news outlets reported this
Liberal2 outletsNorth Korea's hacking of both sides of hiringCenter3 outletsBinance's account of the hack, Pyongyang's denialConservative1 outletA June-to-October timeline of how the heist unfolded
Published 4 min read
Overview

Binance, which runs the world's largest cryptocurrency exchange, said on Tuesday that hackers used fake job interviews on the way to stealing $6.3 billion in crypto. BBC News describes it as the biggest crypto theft recorded so far. Binance's initial findings say that in September an engineer was approached on a legitimate job-hunting platform by a person posing as a project director of a made-up company.

In a second interview he was told to download an "assignment" that carried malicious code. Binance says the attackers then used his computer and an internal AI tool in October to take control of two other engineers' laptops. The New York Post reports the main attack came on Oct. 29 and drained billions from wallets within 20 minutes.

Binance suspended withdrawals worldwide and restored the service on Sunday. It apologised and says it has reserved more than 100% of the money required to cover the loss. Binance cites an FBI finding that North Korea is responsible.

Kim Yo Jong, a top North Korean official, called the accusation a "sinister attempt" by the US to damage North Korea's image.

Key figures
  • $6.3bn stolen from Binance, thought to be the largest crypto hack to date — BBC News
  • within 20 minutes time in which the wallets were drained, per the New York Post — New York Post
  • 98% of impacted token assets replenished as of Saturday, per Binance — BBC News
  • 57 suspected North Korea-linked incidents Binance says it prevented so far in 2026 — Axios
  • 1 in 47 applications from North Korean applicants in 2026, across Pindrop's customer base — Axios

Three sides of the story

Liberal2 outlets

North Korea's hacking of both sides of hiring

Axios opens with a warning to job seekers: its headline says a dream job offer "might be from a North Korean hacker." It reports that North Korea "appears" to have used a fake interview in months of preparation, the exchange said, and says the country's hackers are "weaponizing both sides of the job market." Axios walks through the September contact, a live video call with a fake HR representative and the infected code repository requested in the second round.

It adds Binance's count of 57 suspected North Korea-linked incidents prevented so far in 2026. It also cites Pindrop Security data putting North Korean applicants at 1 in 47 applications across its customer base in 2026, up from 1 in 343 the year before. It ties this to a difficult job market.

NPR's headline puts the engineer first: "A Binance engineer thought he was interviewing for a job. Then the hackers pounced." NPR reports, citing the exchange, that North Korean hackers tricked him with a fake recruitment in the biggest cyber heist ever.

Center3 outlets

Binance's account of the hack, Pyongyang's denial

BBC News leads with Binance's account: the hackers behind the record $6.3bn theft relied on bogus job interviews and a compromised internal AI tool. It quotes Binance calling the breach a "serious and highly sophisticated security incident" and saying "this should not have happened." BBC details the engineer's contact through a job platform, the malware disguised as an "assignment," and the withdrawal suspension that ended Sunday.

It reports that the FBI and Secret Service are helping trace the funds and that Binance says the FBI indicates North Korea is responsible. BBC gives Pyongyang's answer, with Kim Yo Jong calling the accusation a "sinister attempt" by the US, and recalls the $1.5bn Bybit hack of 2025 blamed on the TraderTraitor unit. NewsNation's headline says the hackers "used fake job interview to get in, steal billions."

It reports that the hackers invented a company in an "elaborate plot" and lured a software engineer into opening a file that triggered the hack.

Conservative1 outlet

A June-to-October timeline of how the heist unfolded

The Post's headline puts North Korean hackers and the fake job interviews first, and its report sets out Binance's initial findings as a timeline. It says the findings show a "much more complex process than previously known" that began in June. That month, "Engineer A" downloaded tampered software advertised as a popular AI coding tool.

In September, "Engineer B" was approached on a job-search platform by someone posing as a project director. In the second round, the interviewer posed as the CEO of a fake company, and Engineer B was told to download an "assignment" that held malicious code. On Oct. 20, the Post says, the attacker used his computer and an internal AI tool to take over Engineer A's machine and that of a third engineer, and found a deployment permission token on Engineer A's.

The hackers used Engineer A's stolen credentials to launch the attack on Oct. 29, the Post reports, and emptied billions from the wallets within 20 minutes. It adds that the FBI linked the TraderTraitor group to the heist on Saturday. North Korea has denied any ties, calling the accusation a "grave political provocation," according to state-backed media.

All sources: 6 articles from 6 outlets

Liberal (2)

Center (3)

Conservative (1)