# North Korean Hackers Exploit Fake Interviews to Steal Billions from Binance

*Published November 4, 2026*
*Source: [https://cybersecuritynews.com/fake-job-interviews-binance-heist/](https://cybersecuritynews.com/fake-job-interviews-binance-heist/)*

## Executive Summary

North Korean hackers employed fake job interviews and malicious coding tasks to steal over $6 billion from Binance. The attack involved sophisticated tactics that compromised internal tools and exploited Ethereum features, prompting Binance to overhaul its security measures and absorb the financial loss.

## Article

In a sophisticated cyber attack, North Korean hackers, identified by the FBI as the 'TraderTraitor' group, successfully stole over $6 billion in digital assets from Binance. The attack, which took place on October 29, 2026, was executed through a series of elaborate steps involving fake job interviews, malware-laden coding tasks, and compromised internal tools. Binance estimated the total impact at approximately $6.34 billion.

The hackers initiated their multi-stage campaign in June 2026 when a Binance wallet DevOps engineer unwittingly downloaded a tampered Homebrew package while searching for an AI coding tool. Though Binance replaced the device and updated credentials, the attackers gained intelligence on the wallet infrastructure. A similar Homebrew ad campaign earlier in the year had already introduced the MacSync Stealer malware, as reported by the SANS Internet Storm Center.

In a further escalation, a second engineer was targeted on a job platform by a fake 'Project Director'. The subsequent fake interviews involved a faux HR representative and a fake CEO, each designed to build trust. At the conclusion of the second interview, the engineer was instructed to download a task onto his work computer, which led to the execution of malicious code. This code replaced legitimate files and initiated a shell that evaded detection by endpoint security tools.

On October 20, the compromised computer and an internal AI tool were used to compromise two additional engineers. One of these engineers had access to a container deployment token. On October 29, the attackers used this token to deploy a malicious container, leading to the unauthorized transfer of funds from Binance’s wallets.

The attackers exploited Ethereum’s EIP-7702 feature to manipulate wallet permissions without exposing private keys. This allowed them to execute transactions even after Binance halted withdrawals. To counter the attack, Binance implemented a procedure to clear the unauthorized delegation and managed to freeze or intercept approximately $2.85 billion of the stolen funds. The company has since rebuilt its wallet system, scanned all employee devices, and enhanced security protocols.

Binance has assured users that 98% of affected tokens were replaced by October 31, using funds from its SAFU reserve and company resources. An independent review is underway, and Binance continues to strengthen its defenses against such sophisticated threats.