A fake job interview, a malicious coding assignment and a compromised work computer. These were among the steps North Korean-linked hackers reportedly used to infiltrate Binance before stealing more than $6 billion in cryptocurrency.

According to the investigation report about the $6.3b stolen, Binance detailed how the attackers spent months targeting employees, compromising their devices and working their way into systems responsible for managing the exchange’s crypto wallets. The report shows how a routine recruitment process became part of a sophisticated attack that eventually enabled unauthorised transactions.

According to Binance’s report, the attackers contacted a software engineer through a legitimate job-seeking platform after finding a profile that mentioned the employee’s work at the exchange.

The person introduced themselves as a project director at a company that did not exist and said they wanted to discuss a potential job opportunity.

The recruitment process appeared convincing. During the first interview, someone posing as an HR representative appeared on a live video call. The person also shared a social media account containing personal photographs and videos, helping create the impression that they were genuine.

For the second interview, the conversation moved to a popular messaging application, where the engineer spoke with someone claiming to be the company’s CEO.

Close to the end of the interview, the supposed CEO asked the engineer to download a coding assignment and run it on their work computer.

That request was the trap.The assignment contained a malicious code repository. During installation, the code secretly replaced a legitimate component of pyenv, a tool developers use to manage Python versions, with a trojanised version controlled by the attackers.

The malware then executed commands and communicated with an external server. It also attempted to conceal its activity and remove traces of the intrusion.

The attack had started months ago

The fake interview was not the beginning of the entire operation.

Binance traced the campaign back to June 2026, when another engineer on its wallet development and operations team downloaded a tampered Homebrew installation while trying to install an AI coding tool.

Homebrew is a software package manager commonly used by developers to install tools on their computers.

Binance detected the anomaly, replaced the affected device and rotated related credentials. However, the attackers had already obtained information about the engineer’s role and colleagues working on the exchange’s wallet infrastructure.

That information appears to have helped them identify other employees and systems worth targeting.By September, the attackers had compromised another engineer through the fraudulent recruitment process. On October 20, they used the compromised computer and an internal AI tool to gain control of two additional engineers’ devices.

The attackers subsequently obtained access to credentials and permissions that allowed them to interact with systems involved in wallet operations.

How the attackers reached Binance’s wallets

The compromised employee computers gave the attackers a route into Binance’s internal environment. From there, they worked towards the systems used to authorise cryptocurrency transactions.

According to the exchange’s preliminary findings, the attackers used stolen credentials to deploy a container and execute a malicious script.

On October 29, they began moving cryptocurrency out of Binance-controlled wallets. The attack involved an advanced transaction-authorisation method that enabled unauthorised transfers despite the exchange’s existing security controls.

Binance estimated that approximately $6.34 billion in digital assets were affected by the operation. The FBI has attributed the theft to North Korea, identifying the operation as TraderTraitor.

Binance has described the incident as a multi-stage campaign involving social engineering, malicious software, compromised employee devices and internal tooling, rather than a single isolated breach.

The exchange has since rebuilt affected systems, revoked compromised credentials and tokens, strengthened monitoring and announced plans for an independent cybersecurity review.

Binance has also said it is replenishing affected customer balances using company funds. Its latest update reported that it had replenished approximately 98% of the affected assets. This is separate from recovering the original stolen cryptocurrency.

The takeaway from this hack

The Binance incident demonstrates how attackers can combine technical exploits with human trust to penetrate even a major crypto exchange.

The fake interview was effective because it resembled a normal career opportunity. The malicious assignment was effective because writing and testing code are routine parts of a developer’s job. And the wider campaign succeeded in moving through several layers of the organisation before the unauthorised transfers were stopped.

For professionals sharing their experience and career interests online, the answer is not to disappear from LinkedIn or stop applying for jobs. It is to verify opportunities independently and treat unexpected requests to download or execute code with caution.

For crypto companies, the lesson is equally clear: security cannot depend on employees recognising every sophisticated scam. Systems must be designed to limit the damage when an attacker manages to gain a foothold.

Read also: Treat data as ‘toxic waste’ Vitalik Buterin tells developers