Binance Hack Began With Fake Job Interview, Says Exchange

How the Phishing Attack Escalated

A $6.34 billion theft from the cryptocurrency exchange started with a counterfeit job interview and persisted for five months before any coins were moved, Binance confirmed in a public statement on Tuesday. The breach, which occurred on October 29, was initially reported by the company alongside a media release.

The incident began when an attacker posed as a recruiter and convinced a Binance employee to provide sensitive credentials. The stolen information was used to access internal systems, allowing the hacker to remain undetected for months. Only after the fifth month did the fraudsters transfer the first batch of coins, triggering a full investigation.

What Happens Next?

The fake interview was part of a sophisticated social‑engineering campaign. Binance employees received emails that appeared to come from a legitimate hiring department, complete with official logos and contact details. Once the employee logged in, the attacker captured login tokens and bypassed multi‑factor authentication. The breach exploited a combination of human error and software vulnerabilities, enabling the attacker to navigate the exchange’s internal network.

Binance’s security team traced the attack’s timeline by analyzing server logs and transaction records. They discovered that the first suspicious activity appeared in early November, but no funds were moved until late December. During this period, the hacker quietly siphoned off wallets, creating a complex trail of transactions to obfuscate the theft.

Frequently Asked Questions

Binance has pledged to reimburse affected users and is collaborating with international law‑enforcement agencies. The exchange is also reviewing its security protocols, including tightening identity verification and enhancing monitoring of internal access. Users are advised to enable all available security features and remain vigilant against phishing attempts.

The incident underscores the growing risk of insider threats in the crypto industry. It also highlights the need for robust employee training and multi‑layered defenses. While Binance has not disclosed the full extent of the compromised accounts, the company remains committed to restoring trust and preventing future breaches.