A software engineer received what appeared to be an ordinary approach from a recruiter. The recruiter had a plausible identity, conducted a live video interview and presented a technical assignment in the next round.
The assignment contained malware.
Binance says that the fake recruitment process was one of several suspected entry points used before attackers removed approximately $6.36 billion from its wallets on October 29, 2026. The FBI has since attributed the theft to North Korea and identified the responsible activity as TraderTraitor.
The incident is being described as the largest cryptocurrency theft on record. Its importance goes beyond the amount stolen. It shows North Korean operators using both sides of the employment market: posing as developers to enter technology companies, and as recruiters to compromise the people already working inside them.
What Happened in the Binance Hack?
Attackers transferred approximately $6.36 billion from Binance wallets across 10 blockchains, according to blockchain intelligence firm TRM Labs. Most of the funds moved within about 20 minutes.
The affected assets reportedly included tokens on Bitcoin, Ethereum, Solana, XRP, Arbitrum and other networks. Binance confirmed that one of its connected hot wallets was involved, while stating that most customer assets remained in offline cold storage.
Binance said it had reserved more than $6.34 billion of company funds to cover the losses. The exchange and its blockchain partners also froze approximately $3 billion in affected assets.
A freeze prevents some assets from moving through participating networks, issuers or services. It does not necessarily mean the funds have been recovered and returned. Attackers may still control assets that have already been exchanged, bridged or moved beyond the reach of participating organizations.
Why the FBI Blamed North Korea
The FBI attributed the attack to North Korea and linked it to TraderTraitor, a label used for malicious activity associated with the country’s cyber operations.
The bureau warned that the attackers were expected to continue laundering the stolen assets through decentralized finance protocols and instant-swap services. These tools allow users to exchange assets across tokens or networks, potentially making the money trail more complicated.
Blockchain transactions remain visible, but visibility does not guarantee recovery. Investigators must connect wallets across different networks, determine which services were used and identify the people controlling the addresses. Once assets reach platforms that do not cooperate with sanctions enforcement or identity requests, recovery becomes more difficult.
TRM Labs said features of the attack resembled earlier North Korea-linked thefts. Chainalysis also assessed that TraderTraitor was likely responsible. The FBI’s attribution gives the claim official weight, although the complete forensic record has not been made public.
The Fake Interview Was One Entry Point
Binance said one of its engineers was contacted in September through a legitimate job-search platform by someone claiming to represent a fictitious company.
During the first interview, a person posing as an HR representative appeared on a live video call. The profile had enough personal content and professional history to appear credible.
The second round included a technical assignment. The engineer was asked to download a code repository that had been modified to deliver malware.
Binance also discovered a separate incident in which another engineer downloaded a tampered software installer while attempting to set up an AI coding tool. The security team detected that installation, replaced the device and rotated credentials. The company later said the employee and colleagues may still have been exposed.
Binance identified multiple suspected points of compromise. The evidence therefore does not support reducing the entire theft to one interview or one employee. The recruitment approach appears to have been part of a broader campaign that spent months targeting people with access to valuable systems.
Why Job Interviews Work as an Attack Method
A technical interview gives an attacker something that an ordinary phishing email does not: a believable reason to ask the target to run code.
Software engineers routinely clone repositories, review packages and install development tools. An interview assignment built around those actions can appear consistent with normal hiring practice. The attacker does not need to create panic or promise an implausible reward. The request fits the context.
Job seekers may also be more receptive to new contacts during a difficult employment market. A convincing recruiter, a realistic company profile and several rounds of conversation can lower suspicion before any file is downloaded.
This is social engineering adapted to developers. Instead of asking directly for credentials, the attacker creates a situation in which the target voluntarily introduces malicious software into a trusted environment.
North Korea Is Exploiting Both Sides of Remote Hiring
Fake recruitment is only one part of the operation.
North Korean IT workers have also used stolen identities and fabricated employment histories to obtain real jobs at technology and financial companies. Their wages can then be transferred through accounts, cryptocurrency wallets and intermediaries before reaching organizations connected to the North Korean government.
An October 28 action by the U.S. Treasury sanctioned 10 individuals and one entity connected to these schemes. Two Russian nationals were accused of converting approximately $5.5 million in cryptocurrency for North Korean IT worker networks.
Chainalysis traced one flow from a wallet displaying salary-like stablecoin payments to sanctioned consolidation addresses and then to a Russian intermediary. The funds were ultimately sent to Garantex, a sanctioned Russian exchange, for conversion.
The Chainalysis investigation said the wider IT worker network may generate between $250 million and $600 million in annual revenue for North Korea, citing estimates from a United Nations panel.
There is no public evidence that the Russians sanctioned on October 28 participated in the Binance theft. The cases reveal different parts of the same broader strategy rather than one proven group of defendants.
AI Is Making False Identities More Convincing
North Korean operators have reportedly used generative AI to prepare resumes, write cover letters and practice technical interviews. AI-generated profile pictures and manipulated video can help applicants conceal their real identities during remote calls.
The same tools can support fake recruiters. An attacker can create a company identity, produce professional-looking profiles and maintain convincing written conversations without the language errors that once made fraud easier to detect.
Deepfake video does not have to be perfect. In a short interview conducted through a compressed video feed, minor visual problems may look like ordinary network issues. A candidate or recruiter can also blame camera quality, bandwidth or privacy concerns for keeping the background blurred.
AI did not create the underlying scheme. It reduced the cost of maintaining several false identities and made basic screening less reliable.
The Earlier Sanctions Case Explains the Financial Pipeline
The October 28 sanctions provide useful context for what happens after North Korean operatives receive crypto payments.
The U.S. Treasury alleged that Russian national Ilya Aleksandrovich Boykov converted approximately $3.5 million in cryptocurrency for Alis, a sanctioned company connected to North Korean IT workers. Vitold Viktorovich Obertas was accused of converting nearly $2 million in cryptocurrency and processing at least $1.25 million in other currency transactions for North Korean officials.
Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled organization operating in Russia. Six workers connected to the organization allegedly generated more than $750,000 since 2025.
These designations show that the operation requires more than people who can pass technical interviews. It also needs managers, identity providers, laptop operators, wallet controllers and intermediaries capable of turning digital assets into usable funds.
Sanctioning a wallet may disrupt one route. The network can respond by changing addresses, chains, intermediaries or cash-out services. This is why transaction monitoring must examine relationships and behavior instead of relying only on a static blacklist.
Why Crypto Companies Are Attractive Targets
Crypto companies combine remote work with direct access to transferable value.
Developers may have access to source code, deployment tools, cloud infrastructure or internal wallet systems. Security engineers may work with credentials that protect several networks. An attacker who compromises one endpoint can search for a path into systems holding assets that can move at any hour.
Traditional financial transfers often pass through clearing systems, banks and business-hour controls. A crypto transaction can settle across borders within minutes. That speed benefits legitimate users, but it also shortens the time available to stop a theft.
The Binance incident demonstrates the scale of that problem. Even though blockchain partners reportedly froze close to half the stolen assets, billions of dollars moved before a coordinated response could take effect.
Hot Wallets Remain a Critical Security Boundary
Hot wallets are connected to online systems so exchanges can process withdrawals. That availability makes them more exposed than cold wallets, which keep signing credentials offline.
The AP report cited an outside security expert who questioned whether a compromised authorization may have provided overly broad or long-lasting access to the affected wallet. Binance has not published a complete technical account, and its investigation remains ongoing.
The relevant issue is not simply whether an exchange uses hot wallets. Every active trading platform needs some way to process customer withdrawals. The questions are how much value is kept online, how transaction limits are enforced and how many independent approvals are required for unusual transfers.
A secure cold-storage system can limit the total loss, but it cannot protect assets that have already been moved into an operational wallet. Detection and transaction controls still matter at that boundary.
Freezing $3 Billion Does Not End the Recovery Process
The reported freeze of approximately $3 billion is significant. It also leaves a substantial amount unresolved.
Some blockchain issuers can freeze tokens at the contract level. Exchanges can block deposits connected to identified addresses. Validators, bridges and analytics firms can distribute alerts quickly when stolen assets begin moving.
Other assets are harder to stop. Attackers may exchange tokens through decentralized pools, move across chains, use privacy tools or route funds through services located in jurisdictions that do not cooperate with U.S. authorities.
The FBI specifically warned that DeFi and instant-swap services could appear in the laundering process. That warning does not mean those services participated knowingly. Permissionless tools can be used by both legitimate customers and sanctioned actors.
Recovery will depend on how quickly investigators identify new addresses and how much of the remaining money reaches services capable of blocking it.
What Companies Should Learn From the Attack
The Binance case shows why recruitment security cannot belong only to an HR department.
A credible-looking job contact can become a route into production systems. Code received during an interview should be treated as untrusted software, even when it comes through a recognized employment platform. Testing it on an isolated device or temporary environment can prevent an ordinary career conversation from reaching corporate credentials.
Identity checks also need to continue after hiring. A company that verifies documents on the first day but ignores unusual remote access, device locations or payment changes may miss signs that somebody else has taken over the account.
The FBI’s guidance on North Korean IT workers recommends independently verifying employment history, examining identity inconsistencies and paying close attention to company devices sent to third-party addresses. It also warns about unauthorized remote-access software and U.S.-based “laptop farms” used to conceal a worker’s real location.
For crypto companies, recruitment controls, device security, wallet permissions and sanctions screening must work as one system. The attackers already treat them that way.
Tapbit publishes market analysis and crypto education for readers following the forces shaping digital asset markets. Explore the latest coverage on Tapbit, access an existing account through Tapbit Login, or register with Tapbit to learn more about the platform.
Frequently Asked Questions
Who hacked Binance in October 2026?
The FBI attributed the theft to North Korea and associated it with TraderTraitor. TRM Labs and Chainalysis reached similar assessments based on the attack’s behavior and links to earlier incidents.
How much was stolen from Binance?
Approximately $6.36 billion in crypto assets was transferred from Binance wallets across 10 blockchains. It has been described as the largest cryptocurrency theft on record.
Did Binance lose customer funds?
Binance said it had reserved more than $6.34 billion of company funds to cover the losses and promised to protect users. The company reported that most customer assets remained in offline cold storage.
