Binance Traces Its $6.34 Billion Hack to a Fake Job Interview — and Warns of the Scams Riding on It

Binance has now told the full story of how the largest crypto theft in history happened — and it did not start with a broken blockchain or a leaked private key. It started with a fake job interview. In its first incident report, published November 3, 2026, the exchange describes a months-long campaign that compromised three engineers' computers before a single coin moved, and then drained about $6.34 billion from its hot wallets in roughly twenty minutes on October 29.

It is the most detailed account yet of an attack the FBI has attributed to North Korea's state-linked TraderTraitor group, a charge North Korea denies. And for everyday crypto users, the report carries two warnings: one about how sophisticated these attacks have become, and one about the wave of scams now riding on the hack's aftermath.

How the attack unfolded

The campaign began in June. A wallet engineer searched for a popular AI coding tool and downloaded a tampered Homebrew installer. Binance's security team caught that incident, replaced the device and reset the credentials. But the attackers were patient. On October 20, they used that machine and an internal AI tool to take over the first engineer's system and a third engineer's system as well.

On October 29, the attackers deployed a container and ran a malicious script. Using an internal wallet-signing service, they moved XRP, SOL, OP and BTC out of hot wallets — the online wallets an exchange keeps topped up for day-to-day withdrawals. They also abused Ethereum's EIP-7702 feature to gain partial control of a hot wallet. That wallet used multi-party computation, so Binance had no single key it could cancel to stop the delegation right away. The last unauthorized transfer settled at 23:56 UTC.

The scale is hard to overstate. Blockchain analytics firm TRM Labs put the haul at an estimated $6.36 billion, led by about $3.79 billion in ether and 18,270 bitcoin, spread across ten blockchains. It is roughly four times the previous record, the Bybit theft of February 2025, which the FBI also tied to North Korea.

What has been recovered

Binance says about $2.85 billion of the stolen funds has been frozen or intercepted, mostly by the companies behind stablecoins such as USDT and USDC, which can block their own tokens. Early announcements included more than $1.567 billion in USDT and $823 million in USDC frozen. The exchange says it has replenished 98% of the affected token assets as of October 31, drawing on its $1 billion Secure Asset Fund for Users, its futures insurance fund and its corporate treasury to buy back the stolen tokens.

Withdrawals reopened in phases from Sunday, November 1, starting with bitcoin, ether, BNB, Solana, XRP and dogecoin. On that day alone, analytics firm DefiLlama logged more than $3.5 billion in net outflows as customers pulled funds, and Binance said it processed about $4.6 billion in withdrawals against $1 billion in deposits. The exchange stressed that outflows were stabilizing and represented a small share of assets under management. A proof-of-reserves snapshot taken on October 31 showed ten major assets fully backed, though the zero-knowledge proof meant to verify it independently was still being calculated, with publication expected November 3.

Chainalysis has traced the stolen funds through several rapid conversions into ETH: attackers exchanged $325 million in stablecoins for approximately $285 million in ether in nearly twenty minutes. Native ETH on the Ethereum mainnet has no issuer-controlled freezing key, which is why it is the destination of choice. Bitquery reported attacker-controlled wallets holding 556,271 ETH at 07:37 UTC on November 5.

The second attack: fake compensation scams

The bigger risk for ordinary users right now is not the hack itself — it is the scams riding on it. As Binance reopened withdrawals, fake '$150 reward' and compensation messages began circulating, directing people to a 'rewards hub' or a claim link and promising a payout for the withdrawal pause. They are fake. Binance has announced no refund process that requires users to share passwords, verification codes or wallet credentials, and co-founder Yi He has said proposed community rewards still need regulatory approval and that no cash-voucher campaign is running.

The pattern is classic recovery phishing: a withdrawal freeze creates anxious users who will accept anything that looks like official help. A real recovery process never asks for your password, your two-factor code or your wallet seed phrase. Always type the exchange's official address yourself, and never open a claim link from a message, email or social post.

Vitalik's warning: survival comes first

Ethereum co-founder Vitalik Buterin, speaking to Moneycontrol on November 4, warned that mounting hack risks could make survival the main priority for exchanges over the next two years — ahead of growth. Persistent breaches, he said, could bring tougher regulatory demands. He urged users to ask security questions and to keep funds in wallets requiring multiple signatures.

It is a sobering message from the most respected voice in the industry, and it fits the pattern: Binance says it blocked 57 suspected North Korea-linked threats this year alone. This one got through. Chainalysis has tied more than $14.3 million in losses over 18 months to similar North Korea-linked fake interview schemes — small money next to $6.34 billion, but proof the playbook is reused again and again.

What you should do this week

• If you use a centralised exchange, check your security settings. Turn on two-factor authentication with an authenticator app, not SMS. Review withdrawal addresses and anti-phishing codes.
• Move long-term holdings to a wallet you control. Funds on an exchange are a claim on the company, not coins in your wallet. A hardware wallet or a multi-signature setup is the standard for holdings you do not trade.
• Ignore every compensation or refund message. There is no $150 Binance reward, no rewards-hub claim link, and no refund process that asks for your password or seed phrase.
• Treat job offers and coding-tool downloads with suspicion. The Binance attack began with a tampered installer and a rigged coding assignment. Download tools only from official sources and verify checksums where offered.
• Learn how to verify on-chain. You can track any transaction yourself with a blockchain explorer, and understanding how exchanges prove their reserves will help you judge which venues to trust.

The Binance report is unusually honest for an industry that usually hides its failures, and that honesty is useful: it shows exactly where the defences broke, so every other exchange — and every user — can check their own. The lesson is not that crypto is unsafe. It is that the weakest link is usually a person, a download or a rushed click, and the fix is boring, unglamorous security hygiene. The latest exchange security developments are covered daily on the Zimbuck News page, and you can discuss them with other traders in the Zimbuck Market News group.

FAQ

Was my money lost in the Binance hack?

Binance says customers will not bear the loss. It set aside more than $6.34 billion of its own money to cover the theft, and 98% of the affected token assets were replenished as of October 31. Withdrawals reopened from November 1.

What was the fake $150 reward scam?

Fake messages promising a $150 compensation payout for the withdrawal pause, directing users to a 'rewards hub' or claim link. Binance has warned these are not from the exchange, and there is no compensation campaign running.

How did the hackers get in without stealing private keys?

They compromised engineers' computers over months, then abused an internal wallet-signing service and Ethereum's EIP-7702 feature to authorise transfers. No wallet private keys were leaked, according to Binance's report.

Is Binance.US affected?

Binance.US runs separately and was reported unaffected.

What is the safest way to store crypto?

Keep trading funds on a reputable exchange and long-term holdings in a wallet you control — ideally a hardware wallet or a multi-signature wallet — with your seed phrase stored offline and never shared.

This is market news and general information only, not financial advice. Join the conversation on Zimbuck — the finance social platform for traders and investors: https://zimbuck.com