Binance's $6.3 Billion Hack Began With a Fake Job Offer — and the Exchange Had No Cyber Insurance

Binance's incident report, published on November 3, traces the largest crypto theft on record back to something ordinary: a job offer that did not exist. The world's largest exchange says a five-month North Korean campaign, built on bogus recruiters and tampered developer tools, ended on October 29 with about $6.3 billion drained from its hot wallets. The report also confirms a second, uncomfortable fact: Binance had no cyber insurance to claim on, leaving its own reserves to absorb a record loss. For users, the report matters twice over — it explains how the hack happened, and it explains the wave of scams now riding on its aftermath.The five-month campaign. The first break-in came in June. A staff member setting up an AI coding assistant downloaded a tampered installer, which told the attackers who at Binance worked on its wallet systems. In September, a second engineer was approached about a new job: someone posing as a project director at a non-existent company contacted him through a legitimate recruitment site, a fake HR representative interviewed him by video, and the coding assignment he downloaded for the recruiter's take-home test contained malicious code. The FBI has attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies any involvement. Binance says it blocked 57 suspected North Korea-linked attempts earlier in 2026 before this one got through. TRM Labs estimates that North Korea-linked groups took about 76% of all crypto hack value in the first four months of 2026. Fake recruitment — tracked by Palo Alto Networks as "Contagious Interview" — is one of North Korea's best-documented techniques, and this incident shows why it works: it does not break a firewall, it persuades a trusted insider to run the attacker's code.The money: $2.85 billion frozen, 95% replaced, no insurance. Binance estimates the loss at $6.3 billion, a record for a crypto theft, and says about $2.85 billion has been frozen or intercepted so far. It says it has replaced about 95% of affected funds, using its Secure Asset Fund for Users — a reserve of about $1 billion in Bitcoin — plus its corporate treasury and its futures insurance fund, converting company money into replacement tokens. What it did not have, Bloomberg Law reported citing a person familiar with the matter, was cyber insurance: Binance has not been able to buy it, a position it shares with many crypto firms. It does hold directors' and officers' cover for executives who may face investigations or lawsuits. The practical consequence is that users were made whole from the company's own balance sheet, not from an insurer — which is why the exchange's reserves, and its proof-of-reserves snapshots, have become the story's second act. The next dated milestone is November 4, when Binance plans to publish another reserve snapshot covering additional cryptocurrencies.A second hack in the same week. While Binance was publishing its report, a second exchange was hit. Mercado Bitcoin, one of Brazil's largest crypto exchanges, saw about $48.6 million leave its wallets across 10 blockchains, according to Bitquery's on-chain analysis, with about $11.4 million frozen by stablecoin issuers. Hypernative's preliminary estimate had put the outflows at about $40 million; the exchange itself confirmed a "security incident in one of our systems", halted deposits and withdrawals, and said no customer funds were lost, without giving a figure. Bitquery found the hacker emptied 36,042 customer deposit addresses on Ethereum and, on November 3, began swapping some funds through cross-chain services. Two large exchange incidents in one week, on different continents, is a reminder that exchange security is a sector-wide problem, not a single company's bad week.The second attack: fake compensation scams. The most urgent part of the story for ordinary users is not the hack itself but what followed it. On the morning Binance reopened withdrawals, it had to warn customers to ignore "$150 compensation" offers: screenshots promising a payout for the withdrawal pause — check your reward hub, click this link — are fake, and there is no compensation for the withdrawal pause. Binance's November 2 security advisory warned that fraudsters are impersonating Binance representatives and offering accelerated withdrawals, priority processing, help claiming compensation, or instructions to move assets into a purported Binance vault. The exchange's advice is blunt: anyone promising to expedite a withdrawal for a fee is scamming you. Customers with pending withdrawals should check their status directly in the official Binance application and verify suspicious communications through the exchange's official verification service. No legitimate refund process asks users to share passwords, verification codes or wallet credentials. If a message asks for any of those, it is the scam, not the solution.FAQ: How did the Binance hack start? According to Binance's November 3 incident report, a five-month campaign: a tampered AI coding-assistant installer in June, then a fake job offer in September whose take-home coding test contained malicious code. Who has been blamed? The FBI attributed the attack to TraderTraitor, a North Korean state-backed hacking group; Pyongyang denies involvement. How much was taken and how much frozen? About $6.3 billion taken; about $2.85 billion frozen or intercepted so far, and Binance says it has replaced about 95% of affected funds. Did Binance have cyber insurance? No — Bloomberg Law reported it had no cyber cover to claim on, so losses were absorbed from its own reserves, SAFU fund and treasury. What happened at Mercado Bitcoin? About $48.6 million left its wallets across 10 blockchains (Bitquery), with about $11.4 million frozen; the exchange says no customer funds were lost. What scams should users watch for now? Fake "$150 compensation" offers, fake support agents promising faster withdrawals, and instructions to move assets to a "vault" — none of them come from Binance, and none should ever receive your password or verification code.Read more on Zimbuck: the SIM-swap attack guide is here, https://zimbuck.com/blogs/1008/Your-Phone-Number-Is-Your-Crypto-s-Weakest-Link-How — plus the Zimbuck News page at https://zimbuck.com/pages/zimbucknews and discussion at https://zimbuck.com/groups/zimbuckmarketnews . The incident-report coverage this story draws on is here: https://www.insurancebusinessmag.com/uk/news/cyber/binances-us6-3bn-hack-began-with-a-fake-job-offer-and-it-had-no-cyber-cover-596037.aspx . This is market news and general information only, not financial advice. Join Zimbuck at https://zimbuck.com to follow more crypto security coverage.