Binance: North Korea Stole $6.3 Billion in Crypto Using Elaborate Fake Interview Scheme

North Korean state-backed hackers pulled off what is being called the largest bank heist in history, draining $6.3 billion from crypto exchange Binance through a monthslong scheme involving fake job interviews, tampered software and stolen credentials. In a report issued Tuesday, Binance linked the attack to TraderTraitor, a North Korean cybercrime group known for rapidly laundering stolen funds across global crypto networks. North Korea denied any involvement, with state-backed media calling the accusation a “grave political provocation.” The scheme started small. In June 2026, a Binance employee referred to as “Engineer A” downloaded tampered software disguised as a popular AI coding tool, promoted through fake ads. Binance’s security team caught the malware, replaced Engineer A’s device, and reset all employee credentials. But the attackers already had what they needed: information on Engineer A and his colleagues’ roles within the company. The operation resurfaced in September. A second employee, “Engineer B,” was approached through a legitimate job-search platform by someone posing as a project director. He made it through a first-round interview with a fake HR representative who used photos and videos lifted from a social media account to look credible. In a second round, someone posing as the CEO of a fake company asked Engineer B to download a work “assignment” onto his company computer. The assignment contained malicious code. On October 20, the attackers used that compromised computer, along with an internal Binance AI tool, to seize control of Engineer A and a third employee, “Engineer C.” Through that access, they discovered Engineer A still had a deployment permission token, a specialized credential, sitting on his machine. On October 29, they used it. The hackers launched the attack with Engineer A’s stolen credentials, draining billions of dollars from crypto wallets in just 20 minutes and scattering the funds across global networks. Binance caught the hack that same Thursday evening and moved fast, working with other exchanges and stablecoin providers to freeze roughly $2.8 billion of the stolen funds. About $3 billion was gone for good. Binance paused withdrawals and promised to cover all customer losses in full. As of Saturday, the company said it had replenished 98% of affected tokens and was working to buy the rest. The remaining funds, Binance said in a statement, “are less liquid in the market and take longer to source at the required scale.” To cover the losses, Binance set aside more than $6 billion in company funds, including half of its $1 billion Secure Asset Fund for Users and money from its corporate treasury. It plans to rebuild that fund back to roughly $1 billion. Despite the breach, the company’s balance sheet still shows $157 billion in current total assets. It also saw $4.7 billion in customer withdrawals after the hack, on top of broader market swings. In a statement issued Tuesday, the company, led by co-CEO Richard Teng, acknowledged the scale of the failure. “This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said. The company also laid out what it has done since. “We have taken immediate action to contain the incident and strengthen the systems involved,” Binance said. “The identified entry points used in the attack have been closed, systems touched in the attack path have been rebuilt or replaced, and we have implemented tighter device controls, enhanced wallet-service risk controls and expanded AI anomaly detection.” Lucas Nolan is a reporter for Breitbart News covering issues of AI, free speech, and online censorship.