Binance report: the hack began with a fake job interview

Binance published its initial findings on the 29 October security incident on 3 November 2026. It describes a multi-stage campaign that combined social engineering through fake recruitment interviews, malicious software downloads and compromised internal AI tooling (Binance, Initial Findings and Response Update, 3 November 2026).

The timeline in Binance's report

• June 2026: a supply chain attack. An engineer in Binance's Wallet DevOps team downloaded a tampered Homebrew installation. (Homebrew is a widely used software installer for macOS and Linux.)
• September 2026: a second engineer was contacted through a legitimate job-hunting platform by someone posing as a project director. As part of the "interview", the engineer loaded an "assignment" containing a malicious code repository onto a work computer. Binance says the malware was not detected by its endpoint security tools at the time.
• 20 October 2026: the attacker used the second engineer's compromised computer and an internal AI tool.
• 29 October 2026: between 17:15 and 19:56, the attacker logged onto a third engineer's computer. The unauthorised transfers followed; the last one, of 2,961.9 ETH, was final on-chain at 23:56 UTC.

What was taken and what was frozen

The report puts the impact at approximately $6.34 billion in digital assets, including 18,270 BTC, 233.46 million XRP, about 970,500 SOL and 44.2 million OP. About $2.85 billion had been frozen or intercepted, subject to reconciliation and price movements.

What Binance changed

Binance says it rebuilt the affected wallet system in a new environment, rebuilt the internal AI tool and its access controls, replaced affected devices, withdrew credentials linked to the affected engineers, scanned all employee devices and closed the entry points used in the attack.

For the warning signs of approaches that impersonate trusted organisations, see forex scams: warning signs. The attribution is covered in FBI blames North Korea's TraderTraitor for Binance theft.