Binance has disclosed how North Korean hackers pulled off the $6.3 billion theft that drained its wallets last week: a months-long scheme that combined fake job interviews on LinkedIn with a malicious online ad, company executives told reporters on Tuesday, in a story first published by Fortune. It is the biggest cryptocurrency theft in history.
How the Attack Worked
The hackers targeted a Binance engineer, identified only as “Software Engineer B,” on what the company called a legitimate job-hunting platform. An individual posing as a project director contacted the engineer, whose profile referenced his experience at Binance. The fake recruiter arranged a first-round interview with an HR representative, followed by a second-round interview with someone claiming to be the CEO of a fictitious company. The staged process ended with the engineer downloading an “assignment” that let the attackers into Binance’s systems.
A second engineer had been compromised earlier through a different vector: an internet ad promoting a tampered version of Homebrew, the popular software installation tool. The engineer clicked the ad instead of downloading Homebrew through the company’s regular channels. Binance said it detected and removed the malicious software, but not before the hackers learned critical information about the engineer’s role and about the colleagues who manage the company’s wallets.
Combined, the two footholds gave the North Korean operators the access they needed. The theft itself took place over several hours on October 29, with about $6.36 billion leaving the exchange across ten blockchains, most of it within about 20 minutes, BleepingComputer reported.
The Damage and the Recovery
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in a statement. The company suspended withdrawals for about 48 hours and restored them on Saturday.
Binance said it recovered around $2.5 billion of the stolen funds after Tether and Circle froze stolen stablecoins, and that it has replenished 98% of the stolen coins using reserves and other sources, while maintaining that customer funds are safe. Binance also said it had detected and prevented 57 North Korea-related hacking attempts in 2026 before this one succeeded.
In response to the breach, the company said employees in roles that do not involve public-facing work are now prohibited from maintaining LinkedIn profiles.
FBI Attribution and a Familiar Playbook
The FBI formally attributed the theft to TraderTraitor, a North Korean state-backed group also tracked as the Lazarus Group, Jade Sleet and APT38, in a security alert published October 31. The agency said it has observed the group converting the stolen assets primarily into Ethereum, and expects further laundering through decentralized finance platforms.
The recruiter tactic has a name: Operation DreamJob, a long-running campaign in which North Korean operatives pose as recruiters to trick software developers and crypto employees into installing malware. A similar LinkedIn ruse was used in the $308 million DMM Bitcoin theft in May 2024, and the $1.5 billion Bybit heist in February 2025 also began with a compromised employee computer.
Why It Matters
The Binance disclosure is a reminder that the weakest link in crypto security is rarely the cryptography. It is a job interview. The attackers never had to break a wallet’s private key; they broke a hiring process and an ad network instead. For an industry built on trustless systems, the incident shows how much still depends on the judgment of individual engineers and on the mundane hygiene of where software gets downloaded.
