North Korean hackers used fake recruitment interviews and malicious software to carry out the Binance hack, the cryptocurrency exchange has said, in an attack that resulted in the theft of around $6.3 billion.
Binance executives said one of the company’s engineers was approached on LinkedIn by a person posing as a project director. The employee was then taken through a series of fabricated job interviews and persuaded to download an “assignment” which gave the attackers access to Binance’s systems.
In a report, Binance said the engineer had been contacted through a legitimate job-hunting platform because their profile referred to their work at the exchange. The alleged recruiter arranged an initial interview with a supposed human resources representative, followed by a second meeting with someone claiming to be the chief executive of a fictitious company.
The company said the months-long operation also involved an online advertising campaign promoting a tampered version of Homebrew, a popular software package. A second Binance engineer clicked on the advertisement rather than downloading the software through the company’s usual channels.
Binance detected the fake Homebrew download and removed it from the engineer’s computer, but said the hackers had already obtained information about the employee’s role and the people responsible for managing the company’s wallets.
The exchange said the two attacks, combined with the information gathered by the hackers, enabled them to take control of several Binance wallets and drain their funds.
Binance said employees in non-public-facing roles were not permitted to keep LinkedIn profiles. A company spokesperson did not say whether the engineer had breached that policy or whether either employee would be dismissed.
The exchange said it had previously identified attempts to target staff through LinkedIn and had detected and stopped 57 hacking attempts linked to North Korea during 2026.
The attack took place over several hours on Thursday. Binance said around $2.5 billion of the stolen funds had been recovered after Tether and Circle froze stolen stablecoins.
Withdrawals were suspended for about 48 hours before being restored on Saturday. Binance has said customer funds remain safe and that it has replenished 98% of the stolen coins through reserves and other sources, with the remaining 2%, made up of less widely used currencies, still being acquired.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.
