Binance Says a Fake Job Interview Opened the Door to a $6.34 Billion Theft the FBI Ties to North Korea

Economic Warfare & Trade Policy

Treasury Secretary Janet Yellen and Attorney General Merrick Garland announce Binance's guilty pleas in November 2023 (file photo; not related to the Oct. 29 theft). Photo: United States Department of Justice, Wikimedia Commons, Public domain.

Attackers who stole about $6.34 billion in digital assets from Binance on Oct. 29 got in by posing as recruiters and tricking an engineer into downloading malware during a fake job interview process, the cryptocurrency exchange said in its first report on the attack, Anadolu Agency reported. Binance said the FBI has attributed the attack to North Korea. The exchange pledged to cover the losses and said it had replenished 98% of the affected tokens by Oct. 31 and was buying the remaining, less actively traded tokens.

Key figures: $6.34B digital assets stolen from binance on oct. 29 · $2.85B assets frozen or intercepted, per binance · 98% affected tokens binance says it replenished by oct. 31

How the breach unfolded

According to Binance’s investigation, the operation began in September, when a fake recruiter contacted the engineer through a job platform. After several video interviews, the employee downloaded what appeared to be a coding assignment containing malware that evaded the company’s security software. On Oct. 20, the attackers used the compromised computer and an internal artificial intelligence tool to reach other employees’ devices. Nine days later, they used stolen credentials to access a service that signs wallet transactions, letting them move funds outside the exchange’s normal withdrawal process.

Between 20:05 and 20:09 GMT on Oct. 29, the attackers transferred 233.46 million XRP tokens from five Binance wallets to an address they controlled, the exchange said. They also moved about 970,500 SOL tokens and 44.2 million OP tokens from wallets on the Solana and Optimism networks, followed by 18,270 bitcoin. Binance suspended withdrawals after alerts about unusually large transfers, but the attackers had exploited an Ethereum feature known as EIP-7702 to authorize a malicious smart contract, and that authorization stayed valid on the blockchain. The last unauthorized transfer, of 2,961.9 ether, came at 23:56 GMT; Binance revoked the authorization 14 minutes later.

About $2.85 billion has been frozen or intercepted with help from industry partners, Binance said. It has rebuilt the affected wallet system and the internal AI tool, replaced compromised devices and revoked the stolen credentials, and independent cybersecurity experts are expected to review its findings. TBR’s earlier reporting is in our story on the FBI’s TraderTraitor attribution and our Oct. 30 information war report on the $6.3 billion hack.

Pyongyang denies, Washington responds

Kim Yo Jong, sister of North Korean leader Kim Jong Un, has rejected the FBI finding, calling the “so-called ‘cryptocurrency hacking case by the DPRK'” “no more than a tip of iceberg” of U.S. hostility, in a statement carried by the Korean Central News Agency, Yonhap reported !Unverified claim, KCNA (North Korean state media). A U.S. State Department spokesperson told Yonhap that North Korea “has increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs,” adding that “cryptocurrency heists and laundering have become a significant part of this strategy,” according to Yonhap. North Korea’s missile launch on Wednesday is covered in our Indo-Pacific report on the Sondok launch.

Election-night fact checks

Several false claims spread as Americans voted on Nov. 3. A video shared as an Iranian attack on a U.S. aircraft carrier that day was old and AI-generated: an AI detector rated it 99% likely to be synthetic, and it had been online since at least May 28, Lead Stories found. A claim that the FBI found more than 20,000 fraudulent ballots in a Houston storage locker was false; the FBI said “no election-related operation occurred,” and the story began on accounts that regularly publish satire, Lead Stories reported.

A graphic showing Fox News calling Georgia’s Senate race for Stacey Abrams was fake. “This is not a real image and did not air on FOX News,” a network spokesperson told Lead Stories; the major-party nominees are Sen. Jon Ossoff and Rep. Mike Collins. In New York, officials said a programming update, not paper thickness, caused ballot scanner problems in Westchester County, Lead Stories reported; TBR covered the scanner failures in our Westchester report.

Inauthentic accounts in Armenian diaspora groups

The Atlantic Council’s Digital Forensic Research Lab analyzed 204,552 posts from 83 public Armenian diaspora Facebook groups, written by 7,395 authors between March 1 and June 18, around Armenia’s June 7 parliamentary elections, DFRLab reported. The most active 1% of authors produced 38% of posts, and 65% of posts were reshares with little or no original text. Researchers also found a network of 17 seemingly inauthentic accounts, in two clusters, that posted nearly identical content promoting opposition leader Gagik Tsarukyan and his Prosperous Armenia party.

Iran’s Islamic Revolutionary Guard Corps claimed that four oil tankers were destroyed by naval mines near the Strait of Hormuz, Mehr News Agency reported !Unverified claim, Mehr (Iranian state-affiliated media); the claim has not been independently confirmed. U.S. warnings about cyber and other threats are collected on our national security threats page.

By the numbers

By TBR calculations from Binance’s figures, about $3.49 billion of the stolen assets had not been frozen or intercepted.

Watch for the independent review of Binance’s findings, any new U.S. sanctions or indictments tied to the theft, and further KCNA statements.

Sources

• Anadolu Agency: Binance says hackers used fake job interviews in $6.34B crypto theft
• Yonhap News Agency: (LEAD) N. Korea says dialogue with U.S. an option but not a must for national interest
• Yonhap News Agency: U.S. reiterates concerns over N. Korean cybercrime following Kim Yo-jong's denial of Binance theft
• Lead Stories: Fact Check: Old Video Does NOT Show Iranian Attack On U.S. Aircraft Carrier On Nov. 3, 2026 — It's AI-Generated Clip
• Lead Stories: Fact Check: FBI Did NOT Find More Than 20,000 Fraudulent Ballots in Houston Storage Locker, 'All For Democrats'
• Lead Stories: Fact Check: Fox News Did NOT Call Georgia Senate Race For Stacey Abrams, Who Is Not Running
• Lead Stories: Fact Check: Paper Thickness NOT Cause Of Westchester County Ballot Scanner Problems — Officials Clarified That Programming Update Caused Issue
• DFRLab: How political messaging spread in Armenian diaspora Facebook groups before the 2026 elections
• Mehr News Agency: IRGC says 4 oil tankers destroyed, 56th US drone downed

Additional sources

• Anadolu: Iran claims 4 oil tankers destroyed by naval mines near Strait of Hormuz