Hackers used fake job interview to steal $6.3 billion from Binance

Crypto exchange Binance says hackers stole $6.3 billion in what it calls the largest crypto theft to date. In a postmortem, the company said the attackers combined well-known hacking methods over a few months.

The attack started in June, when one developer downloaded a tampered installer. Binance said the file spread through a malicious Google ad and exposed details about the engineers and how they work. In September, the attackers turned to another engineer. Someone posing as a recruiter set up a series of calls and several rounds of interviews. They shared social media pages to build trust. Then they asked the engineer to download a fake interview assignment.

Binance's postmortem centres on the fake job interviews and an internal AI tool. The attack is an example of social engineering, where victims are tricked into giving access rather than breaking into systems directly.

How the attack unfolded

The campaign relied on trust at each step. A poisoned download gave the attackers an early foothold. The fake recruiter then used a long, realistic hiring process to get a second engineer to run their software. Binance has said the attackers combined several known techniques rather than using a single new exploit.

It is not yet known how the stolen funds were moved or whether any of them have been recovered. Binance has not said how many accounts or customers were affected by the breach. It is also not yet known what changes the company has made to its hiring and software checks.

Anyone who receives an unexpected recruitment approach asking them to run a file should verify the sender before doing so.