A Binance engineer thought he was interviewing for a job. Then the hackers pounced

A Binance software engineer was approached through a legitimate job platform in September and went through two interviews for what appeared to be a new role. According to Binance’s initial investigation, the supposed employer was fictitious. Near the end of the second interview, the engineer was asked to download a coding assignment onto his work computer. The repository contained malware that ran during setup. Binance says this was one stage of a campaign that had begun months earlier and also involved a separate compromised device and internal systems.

On 29 October, attackers moved approximately $6.34 billion in digital assets from Binance wallets, making it the largest cryptocurrency theft recorded to date. The FBI has attributed the attack to North Korean actors it calls TraderTraitor. Binance says it has set aside enough company funds to cover the loss and had replenished 98% of the affected token assets by 31 October. It also reported that about $2.85 billion had been frozen or intercepted as of 3 November, though that figure remains subject to reconciliation. Its investigation and an independent security review are continuing.