Binance has shared new details about a major security breach in which $6.34 billion in digital assets were affected. The company says the attack began when a hacker posed as a recruiter and persuaded an employee to download malicious code during a fake job interview.
The breach followed earlier attempts to target Binance staff. The company said it had detected and stopped dozens of attacks by North Korean actors during 2026. In one incident, a Binance engineer downloaded a malicious Homebrew installer while looking for a popular AI coding tool through a search engine. Binance prevented that attack, but the hackers learned the engineer’s role and identified colleagues on the company’s wallet infrastructure team.
In September, another engineer was approached on a job-hunting platform and took part in several interview rounds with a company that did not exist. The person posing as an employee eventually asked the engineer to download an assignment containing malicious code.
The attacker took control of that employee’s computer and used it to access the systems of the first engineer and a third Binance employee. Days before Halloween, the hacker used credentials stolen from the first engineer to access the third employee’s computer and carry out the attack that led to the theft.
Binance says $2.85 billion in digital assets have been frozen or intercepted. The company has also said it will absorb the financial impact and reimburse users for the stolen funds.
Sources: Mashable.