Binance Says Fake Recruiter Hack Enabled Record $6.3 Billion North Korean Crypto Heist
Binance says North Korean hackers used fake recruiter profiles and malware to steal a record $6.3 billion, forcing it to suspend customer withdrawals.
Summary
Binance confirmed on Tuesday, November 3, 2026, that North Korean hackers stole a record $6.3 billion in crypto the previous week, forcing the world’s largest crypto exchange to suspend customer withdrawals. The FBI and blockchain investigators blamed North Korea, which has been accused of funding its internationally sanctioned nuclear weapons program through cryptocurrency theft.
In the months-long operation, fake social media profiles posing as recruiters led a Binance wallet engineer through two interviews before delivering a malicious coding assignment. Binance’s security tools missed the malware on the work laptop, giving attackers access to an internal tool capable of taking over two other wallet engineers’ computers. One had downloaded a tampered, password-stealing app from search results months earlier. Binance replaced that laptop, but stolen credentials later opened a third engineer’s computer and systems controlling billions of dollars in crypto.
Researchers, cybersecurity companies and the U.S. government had repeatedly warned that North Korean operatives impersonate recruiters, investors, venture capitalists and remote IT workers, sometimes using stolen American identities. About half of all intrusions at U.S. technology companies last year were attributed to such operatives, while Binance had faced at least 57 suspected North Korean attacks. Binance said the breach should not have happened, added safeguards and commissioned cybersecurity experts to review it, but declined to address controls on untrusted software or whether third parties had audited its network. Investigators will examine how familiar tactics bypassed Binance’s defenses in history’s largest crypto theft.
Positives
- Binance suspended customer withdrawals across its network after discovering the record $6.3 billion theft.
- Binance replaced one engineer’s compromised laptop after identifying an earlier password-stealing infection.
- Binance added security measures and is bringing in cybersecurity experts to review the incident.
- The FBI and blockchain investigators attributed the heist to North Korea, establishing a focus for the investigation.
Risks & concerns
- $6.3 billion in crypto was stolen, making the Binance breach the largest cryptocurrency theft in history.
- Binance’s security tools failed to detect malicious code delivered through a fake coding assignment.
- An internal tool let attackers reach two additional wallet engineers’ work computers.
- Credentials stolen months earlier remained useful even after Binance replaced the infected engineer’s laptop.
- At least 57 suspected North Korean attacks had already targeted Binance before the successful heist.
- Binance declined to explain its controls on untrusted software or whether third parties had audited its network.