Binance has revealed that fake job interviews on LinkedIn helped hackers steal $6.3 billion from its crypto accounts.
The recruitment scheme, combined with an earlier attack on another engineer, gave hackers access to wallets in what it described as the biggest theft in crypto history, according to Binance. The cryptocurrency exchange has reportedly disclosed that North Korean attackers approached an engineer on LinkedIn, staged interviews with supposed company representatives and persuaded the employee to download a malicious assignment.
Binance said it had previously detected and prevented 57 North Korea-related hacking attempts in 2026. Binance suspended withdrawals for approximately 48 hours before restoring them. The exchange said it recovered around $2.5 billion of the $6.3 billion stolen after Tether and Circle froze stolen stablecoins, cryptocurrencies designed to track the value of assets such as the US dollar. Separately, Binance said it had replenished 98% of the stolen coins using reserves and other sources, while maintaining that customer funds were safe. It was still acquiring the remaining 2%, consisting of less widely used currencies.
The staged recruitment process led the engineer to download an assignment that let the attackers into the company’s systems, executives told reporters. A Binance spokesperson said employees in roles that do not involve public-facing work are prohibited from maintaining LinkedIn profiles. The employee downloaded it through the advertisement rather than the company’s approved channels, according to Binance. Binance said it detected and removed the malicious software. The company said that information, combined with the fake recruitment operation, enabled the hackers to take control of several wallets and drain funds.
“Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B’s profile on the platform referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company,” the company noted. The spokesperson declined to clarify whether the engineer had breached that policy or whether either employee involved would be dismissed. However, the attackers had already obtained information about the engineer’s responsibilities and other employees who managed company wallets. The theft took place over several hours last week. You use AI every day. Now get your AI Quotient. Take the AIQ test.
The attackers had earlier targeted a different engineer through an online advertisement promoting a tampered version of Homebrew, a tool used to install and manage software.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in a statement seen by Fortune. The company said the operation unfolded over several months, using social engineering to manipulate people into sharing information or taking unsafe actions, along with malicious software. Binance said an individual posing as a project director contacted an engineer whose professional profile mentioned experience at the exchange.