Binance has disclosed that hackers behind the $6.3 billion attack on the cryptocurrency platform gained access to the company’s systems through a fake job interview and malicious software disguised as a legitimate application.
Binance, in a preliminary report released on Tuesday, November 3, said the sophisticated cyberattack began in June and involved multiple stages that culminated in the theft of billions of dollars’ worth of digital assets on October 29, 2026.
The exchange revealed that the attackers first compromised the computers of two software engineers before using a third employee’s device to gain access to critical systems and execute unauthorised cryptocurrency withdrawals.
Binance said one engineer unknowingly downloaded a compromised software tool, while another installed a malicious code repository after participating in what appeared to be a legitimate recruitment process, including a virtual interview with the supposed chief executive of a fictitious company.
Binance disclosed that on October 20, the attackers used one compromised computer and an internal artificial intelligence tool to gain control of additional systems. Nine days later, they launched the attack by triggering a malicious script with stolen credentials.
The exchange said within four minutes, the hackers transferred 233.46 million XRP tokens from five Binance internet-connected wallets before moving other cryptocurrencies, including Bitcoin.
Binance said it immediately launched an investigation after receiving alerts over unusually large transactions.
The exchange suspended withdrawals, revoked unauthorised permissions and froze affected assets, but noted that some transactions continued for nearly four hours before the breach was fully contained.
Binance resumes withdrawals after $6.3bn crypto heist
About $2.85 billion worth of assets have so far been frozen, while Binance has pledged to reimburse all affected customers.
The United States Federal Bureau of Investigation (FBI) has attributed the attack to a North Korean hacking group, an allegation Pyongyang has denied.
Binance apologised to users for the incident, describing it as a sophisticated and coordinated attack.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” the company stated.
The company also announced plans to strengthen its security architecture by expanding AI-powered threat detection, establishing a dedicated cybersecurity research fund, and collaborating with leading artificial intelligence firms to improve its defences against future attacks.
- ‘I’m not fit to be in office after 2 accidents’: Spanish transport minister resigns after deadly train crash - November 4, 2026
- How hackers used fake job interview in $6.3bn attack ― Binance - November 4, 2026
- Oil prices rise after Trump’s Republicans defeat in US midterm elections - November 4, 2026
