The $6.3 Billion Binance Hack: How a Fake Job Interview Led to the Biggest Crypto Theft Ever

It started with a job offer

Most people picture a crypto hack as some genius typing green code in a dark room. The real story of the Binance hack is much more ordinary, and that's what makes it scary.

It started with a message on a job site. A Binance engineer was offered an interview. The interview had a coding test. The coding test had a hidden trap.

A few months later, on October 29, 2026, around $6.3 billion in crypto walked out of the world's biggest exchange in roughly 20 minutes. It is now the largest crypto theft on record, and some experts say it may be the largest theft of any kind, ever.

Binance has now shared how it happened. Here is the full story, step by step, without the jargon.

What happened on October 29

At 20:05 UTC on October 29, five Binance wallets on the XRP Ledger suddenly sent 233 million XRP to a single unknown address. Fifteen minutes later, the same thing started happening on Bitcoin, Ethereum and Tron. Then Solana. Then a handful of smaller networks.

The money was coming out of Binance's hot wallets. Think of a hot wallet as the cash drawer at a bank counter. It stays connected to the internet so customer withdrawals can go out quickly. Most of an exchange's money sits in "cold" storage, offline, like a vault. But the drawer still holds a lot, and at Binance's size, "a lot" means billions.

Binance froze all trading, deposits and withdrawals. Within the hour, blockchain watchers on social media were calling it the biggest hack they had ever seen. They were right.

How the hackers actually got in

On November 3, Binance co-CEO Richard Teng published the company's account of the attack. His main point: this wasn't one clever trick. It was "a campaign built over many months." The attackers, he said, "combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques."

Here's how it played out.

June: a fake AI tool. One Binance engineer installed what looked like a popular AI coding assistant. It was malware. It gave the attackers a window into that person's work and, more importantly, showed them who on the team worked on Binance's wallets.
The recruiter. A Binance engineer was approached on an online job site. First by someone posing as an HR person, then by a "project director." They studied the engineer's social media to sound believable and build trust.
The interview. The engineer was then interviewed over a chat app by someone claiming to be the CEO of a company that didn't exist. As part of the process, the engineer was asked to download a coding assignment. Hidden inside that code was malware. Binance later said the infected machine belonged to a DevOps engineer.
October 20: spreading inside. Nine days before the theft, the attackers used that laptop as a stepping stone. They broke into the computers of two more engineers who worked directly on Binance's digital wallets. According to Binance, they misused the company's own internal AI tool to help take control of those machines.
Reaching the money. With stolen login details, the attackers got into a "service container", basically a small piece of Binance's internal system that can send out withdrawals. From there, they could submit withdrawal requests that looked legitimate.
October 28–29: final checks. Blockchain firm TRM Labs found the attackers' main wallet had been topped up with small amounts through Tornado Cash, a privacy tool, more than 36 hours before the heist. On the day itself, they tested their code on several wallets first.

One detail stands out. Teng said the attacker used "a self-destruct mechanism that destroyed tooling and tracers." In plain words, once the job was done, their tools wiped themselves to make the investigation harder.

Binance says it has seen no evidence that its private keys, the master passwords to its wallets, were leaked. The hackers didn't need them. They got the system to sign the withdrawals for them. TRM Labs reached a similar conclusion: the attacker most likely gained control of Binance's hot wallet signing system itself.

The 20-minute heist

Months of preparation, and then most of the money left in about 20 minutes.

The Bitcoin wallet went first after XRP, sending out 18,270 BTC. The attackers immediately chopped it into smaller pieces of 1,000 and 100 BTC to make it harder to follow. Within two minutes, a Tron wallet sent out 612.7 million USDT.

Ethereum was the biggest hit, and the most clever part. The attacker sent one transaction carrying 50 pre-signed approvals from Binance's Ethereum hot wallet. These used a newer Ethereum feature called EIP-7702, which lets a normal wallet hand its controls over to a piece of code. Here, that code was a "sweeper" built to empty the wallet. About three and a half minutes later, it pulled out 167,464 ETH plus 63 different tokens, including 1.6 billion USDT. A single transaction moved more than $2.5 billion.

The attackers kept coming back for more through the evening. A second wave hit Binance wallets on Avalanche and Polygon around 23:05 UTC. The last Ethereum sweep came just before midnight. Binance finally cut off the attacker's access to its hot wallet a little after that.

Here's roughly what was taken, according to TRM Labs:

Network	What was taken	Value (USD)
Ethereum	200,630 ETH, 1.875B USDT, 823M USDC, 88.5M RLUSD and 185 other tokens	~$3.79 billion
Bitcoin	18,270 BTC	~$1.47 billion
Tron	612.7M USDT and 46.4M TRX	~$628 million
XRP Ledger	233.46M XRP	~$296 million
Solana	970,500 SOL	~$96 million
Arbitrum, Optimism, Base	Including 74.6M ARB	~$39 million
Avalanche	Various	~$28 million
Polygon	Various	~$10 million
Total		~$6.36 billion

To put that in perspective, the previous record was the Bybit hack in February 2025, at about $1.5 billion. This one is roughly four times bigger.

Who was behind it

Within a day, TRM Labs pointed the finger at TraderTraitor, a North Korean hacking unit linked to the wider Lazarus Group. Another blockchain firm, Elliptic, came to the same conclusion. It found some of the stolen money landing in a wallet used in an earlier $351 million attack on the exchange Bitget.

Over the weekend, the FBI said the same thing: this was North Korea. The bureau published the attackers' Ethereum, Bitcoin and Solana addresses and asked the public for any information. North Korea denied it on Monday, as it usually does.

The fingerprints were familiar. The same group was behind the Bybit hack in 2025 and has been tied to the KelpDAO hack in April 2026. The playbook matches: fund a wallet through Tornado Cash, prepare well in advance, then fire off pre-signed transactions all at once.

The fake job interview trick isn't new either. North Korean hackers have been using fake recruiters to target crypto developers for years. Security researchers say the country steals crypto mainly to fund its weapons programs. Binance itself says it blocked 57 attacks from North Korea-linked hackers in 2026 alone. This one got through.

The race to freeze the money

Here's where the story takes a better turn. A big chunk of what was stolen was stablecoins like USDT and USDC. Unlike Bitcoin, these coins are run by companies, and those companies can freeze them.

They moved fast. Tether started freezing wallets less than an hour after the attack began. Circle followed minutes later. By the end, around $2.7 to $3 billion was locked up:

Tether: about 1.77 billion USDT
Circle: about 825 million USDC
Ripple: 40.5 million RLUSD
World Liberty Financial: 27.8 million USD1
Arbitrum Security Council: 8,426 ETH and 74.6 million ARB (about $30 million)

The hackers knew this could happen, so they rushed to swap stablecoins into coins that can't be frozen. They sold about 325 million USDT for ETH on UniswapX, taking a loss of around 10% just to get out quickly. They also borrowed ETH on Aave using stolen USDT as collateral, until Aave froze those markets. On Tron, 300 million USDT was moved into the lending platform JustLend. Around 48 million RLUSD was dumped before Ripple could freeze the rest.

That still leaves a lot. TRM Labs says the attackers hold over 420,000 ETH and all 18,270 BTC, together worth about $2.4 billion. Investigators describe it as a "cat and mouse game." The FBI, the US Secret Service and the Justice Department are all involved.

Turning that much crypto into real cash isn't easy. It usually means bridges between blockchains, swap services and shady over-the-counter brokers, and it can take weeks or even years. Every step is a chance for someone to spot and freeze it.

Did Binance users lose money?

According to Binance, no. The day after the hack, the exchange said it would cover every loss and set aside around $6 billion to do it. The money came from its SAFU emergency fund (short for Secure Asset Fund for Users), its futures insurance fund, its Bitcoin reserve and its own company treasury. Binance used it to buy back the stolen coins.

By October 31 it said 90% of the missing assets had been replaced. The rest were smaller, harder-to-buy tokens. By the time of its November 3 report, it said that figure was up to 98%. Founder Changpeng Zhao put it simply: "The users did not suffer any loss."

Withdrawals were frozen for nearly two days. They reopened on Sunday, November 1, starting with ETH, USDT, USDC and some tokens on BNB Chain. Binance says that by Tuesday, more money was coming in each hour than going out. It has also promised to publish fresh proof of reserves, a public check that it holds enough assets to cover all customer balances.

The wider market still felt it. Bitcoin dropped around 4–5% and slipped below $80,000. Shares of Coinbase and Robinhood fell too.

As for fixing the hole, Binance says it is:

rebuilding the affected wallet infrastructure from scratch
redeveloping the internal AI tool the hackers abused
adding stronger security scans and an AI-powered threat detector
setting up a security research fund and working with leading AI companies

What we should take away from this

The uncomfortable part of this story is how little "hacking" was involved at the start. Nobody cracked Binance's encryption. Someone installed a tool that looked useful. Someone else took a coding test for a job that seemed real. That was enough to open the door.

A few lessons are worth repeating, whether you work in tech or not:

Be suspicious of unexpected job offers, especially ones that ask you to download and run code. Do coding tests in a separate, throwaway environment, never on your work laptop.
Only install tools from official sources. Fake versions of popular AI tools are now a common way in.
One laptop should never be a key to the vault. Companies need to limit what any single device or person can reach.
If you keep crypto on an exchange, you are trusting that exchange. Binance could cover $6 billion. Most companies could not.

The investigation isn't over. About $2.4 billion is still out there, and the hunt for it could go on for years. But the way in has already been answered, and it's a reminder that the weakest point in any system is usually a person having a normal day at work.

CodeGranted