Fake Job Interview and a Poisoned Search Ad Behind Binance's Record US$6.3 Billion Crypto Heist

Binance has revealed how attackers pulled off what could be the largest financial theft ever recorded. In its initial report, the exchange said hackers compromised the computers of two software engineers using a fake job interview and software hidden in an advertisement. They then used a third engineer's computer to drain US$6.3 billion (about $9 billion) in crypto. The FBI has blamed a North Korean hacking group, which North Korea denies. Binance says it is repaying all customers whose funds were stolen.

The attack was a multi-stage effort that began in June, when an employee on the wallet developer team downloaded a tampered tool from the internet. A person familiar with the incident said the malicious version was placed in an advertisement, so it appeared higher in search results than the genuine tool. Binance said it detected this, replaced the device and changed credentials, but the roles of that employee and others on the wallet team were exposed. Even after Binance detected the theft and froze withdrawals, the hackers kept taking crypto for nearly four hours.

Researcher Michael Barnhart of DTEX said experts and governments have long warned that North Korean and other hackers use phony job interviews to target employees. Binance said it detected and prevented 57 suspected North Korea-linked threats in 2026, which Barnhart said shows the exchange is "just getting barraged".