What happened
- Binance published on 3 November 2026 an incident report on the 29 October cryptocurrency theft, valued at US$6.3 billion. BleepingComputer reported it the same day.
- The FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38.
- According to Binance, it all began in September, when a software engineer was contacted on a legitimate job platform by someone posing as a project director at a fictitious company.
- After two interviews, one by video with a supposed human resources representative and another over a chat app with a supposed chief executive, the engineer downloaded a coding test from a code repository. That code installed malware that antivirus tools did not detect.
Why it matters
- The attack did not start with a technical flaw but with a credible job offer aimed at someone whose profile mentioned their experience at Binance.
- “The 0-day malware was not detected by the endpoint security protection tools at the time,” the company wrote.
- From that computer the attackers reached the wallet infrastructure: by 20 October they had compromised two more employees working on it and obtained credentials and a container deployment token.
The number
US$2.85 billion. That is how much of the stolen assets had been frozen or intercepted as of 3 November, according to BleepingComputer.
Context
The malware replaced a legitimate component of a development tool to run commands and talk to an attacker server. Specifically, it created a fake executable in the Homebrew installation folder on macOS, deleted the legitimate pyenv and took its place. On 29 October, with the stolen credentials, the attackers deployed a script and entered Binance’s wallet signing service, which let them move cryptocurrency across several blockchains. They also abused Ethereum’s EIP-7702 authorisation mechanism to keep stealing after the platform suspended withdrawals. Binance says it rebuilt the affected systems, replaced compromised devices and revoked the stolen credentials.
At Mamífero we follow breaches and how attackers get in. We reported that Quest Diagnostics confirmed an attacker accessed patient records and that Anthropic closed Claude sessions stolen by malware. On digital trust, Firefox, Chrome and Apple blocked eight eMudhra certificates, and in cryptography, Project Eleven and Relm are exploring whether post-quantum defence lowers insurance costs.
What’s next
- Binance continues to trace the stolen funds with other platforms and authorities.
- The report gives technical details, such as the pyenv replacement, that other teams can look for on their own machines.
- Fake job offers aimed at engineers at cryptocurrency companies remain a documented way in.
Bottom line
The Binance theft did not start on the blockchain but in a job interview. A coding test downloaded by one engineer was enough for the attackers, six weeks later, to sign transactions as if they were the company.
Sources
- BleepingComputer, “Binance says fake job interview led to $6.3 billion crypto heist”, 3 November 2026, bleepingcomputer.com. It reproduces Binance’s incident report, which could not be read directly.
- TechCrunch, “Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist”, 3 November 2026, techcrunch.com
- Cover image: Bretwa, CC BY-SA 4.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
