Fake Recruiters Trigger Mega Crypto Heist

Stack of assorted cryptocurrency coins with a gold bitcoin in the center
Photo: Yourg / Shutterstock

Hackers posed as job recruiters, tricked a Binance engineer into running hidden malware, and used that opening to steal $6.3 billion in crypto in one of the biggest thefts ever recorded.

Quick Take

  • Binance co-CEO Richard Teng says attackers posed as recruiters, interviewed a Binance engineer, and sent a coding test loaded with hidden malware.
  • The malware reportedly gave hackers a path from one engineer’s laptop to an internal system that could approve withdrawals.
  • Blockchain tracking firm TRM Labs says roughly $6.36 billion left Binance wallets across ten blockchains, with most of it gone in about 20 minutes.
  • Teng says Binance has replaced 98% of the stolen funds and is still buying back the rest.
  • Security researchers say the attack has hallmarks similar to past North Korea-linked hacking campaigns against crypto firms.

Fake Recruiters Targeted a Binance Engineer

Binance co-CEO Richard Teng told CNBC on November 3 that the breach started in September. Hackers pretending to be recruiters contacted a Binance engineer, ran him through interviews, and then sent a coding exercise. That file carried hidden malware built to slip past security tools. The engineer’s laptop became the attacker’s foothold inside Binance’s network.

Binance’s own preliminary report, released October 30, said the incident “may involve a compromised DevOps engineer’s laptop,” which let an attacker reach a service container able to submit unauthorized withdrawal requests. That container became the bridge between a single infected laptop and Binance’s much larger financial systems.

Teng said Binance has since rebuilt the affected wallet system and an internal artificial intelligence tool tied to the breach. The company replaced compromised devices, canceled related credentials and login tokens, and widened security checks on employee devices. Those steps point to a real internal compromise, not just an external glitch.

How the Money Moved So Fast

Security researchers found a technical trigger behind the theft: a newer Ethereum feature called EIP-7702, which lets a crypto wallet temporarily act like a smart contract. Investigators identified 50 pre-signed authorizations tied to this feature, and one matched Binance’s wallet activity exactly. That authorization handed control of the wallet to code written by the attacker, who then emptied it.

Blockchain analysis firm TRM Labs estimated that about $6.36 billion moved out of Binance wallets across ten different blockchains. Most of that money left in roughly 20 minutes, a pace that points to an automated, pre-planned operation rather than a slow, manual theft.

Binance Says Most Funds Are Replaced

Teng said Binance has replenished 98% of the $6.34 billion in affected assets and is still working to buy back the remaining, harder-to-find holdings. The company has not published a detailed public breakdown showing exactly which assets were returned, repurchased, or frozen, so the full accounting behind that number is not yet public.

This is not the first time a major exchange has had to rebuild reserves after a massive theft. In February 2025, hackers linked to North Korea’s Lazarus Group stole roughly $1.4 to $1.5 billion from Bybit by compromising its wallet-signing system. Bybit restored its reserves within about 72 hours using emergency funding from outside trading firms.

Possible North Korea Connection

Security researchers say the Binance attack carries hallmarks of “TraderTraitor,” a hacking method the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Treasury Department have linked to North Korean state-backed hackers since at least 2020. That pattern typically starts with fake job offers sent to crypto-company engineers. No U.S. government agency has publicly named a specific group behind this particular Binance breach.

For everyday crypto users, the case is a reminder that even the world’s largest exchanges can lose billions in minutes through a single tricked employee. Binance says normal operations and withdrawals have resumed, and the company has published a reserve verification covering major assets like Bitcoin, Ethereum, and Tether. Whether that rebuilds full trust will depend on what further details Binance releases in the weeks ahead.

Sources:

insiderpaper.com, cnbc.com, securityweek.com, crystalintelligence.com, lcx.com

Breaking Stories

© 2026 News Broadcast. All Rights Reserved.