# The $6.3B Binance Hack Started With a Fake Job Interview. Hiring Is Now an Attack Surface. > Binance says its $6.3 billion hack began when an engineer was lured by a fake recruiter at a fictitious company. What happened, and how to verify both sides of a hire. *Published 2026-11-09 · 8 min read · TamperCheck.ai* Canonical: https://tampercheck.ai/blog/binance-hack-fake-job-interview-hiring-fraud --- On 3 November 2026, Binance published an incident report on the largest crypto theft on record: about **$6.3 billion** taken from its wallet infrastructure between 29 and 30 October. The entry point it described was not a zero-day in its exchange. It was a job offer. According to Binance, a software engineer was approached in September on a legitimate job-hunting platform by someone posing as a project director at a **fictitious company**. A fake HR representative ran a live video interview and shared a social media account full of personal photos to build trust. A second interview, with a supposed CEO, ended with a coding assignment that installed custom malware ([BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/), [CoinDesk](https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says)). Binance co-CEO Richard Teng told CNBC the attackers "spent months building their way in" ([CNBC](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html)). ## Key takeaways - **The way in was a fake employer.**: A fictitious company, a fake project director, a fake HR rep and a fake CEO walked an engineer into running malware. - **It took months.**: The first related compromise dates to June 2026. The job approach came in September, lateral movement on 20 October, and the theft on 29 October. - **The FBI attributes it to North Korea.**: Reporting links the attack to the TraderTraitor group, also tracked as Lazarus. North Korea has rejected the claim. - **Hiring fraud runs both ways.**: The same state-linked groups also place fake candidates inside companies using stolen identities and forged paperwork. ## The timeline Binance described From Binance's report, as summarised by [BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/), [CoinDesk](https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says), [CNBC](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html) and [NBC News/Reuters](https://www.nbcnews.com/business/markets/binance-hack-fake-job-interview-heist-rcna607238): - **June 2026:** a wallet DevOps engineer searching for a popular AI coding tool installed a tampered Homebrew package. Binance replaced the device and rotated credentials. - **September:** a second engineer was approached through a job platform by a "project director" at a fictitious company. After a video interview with fake HR and a chat-app interview with a fake CEO, he downloaded a coding assignment that installed malware his endpoint tools did not detect. - **20 October:** using that machine and an internal AI tool, the attackers reached two wallet engineers and took their credentials and a container deployment token. - **29 October:** the attackers deployed a container, reached the wallet signing service and began moving funds at 20:05 UTC. Containment took until 00:10 UTC on 30 October. - **3 November:** Binance published its report. About $2.85 billion had been frozen or intercepted, and Binance says it replenished affected assets from company funds. - **$6.3B**: taken from Binance wallet infrastructure, per Binance - **4**: fake personas: project director, HR rep, CEO, and the company itself - **57**: suspected North Korea-linked attempts Binance says it blocked this year (CoinDesk) ## Hiring is an attack surface in both directions The Binance case is the **"fake employer"** pattern: attackers pose as a company that is hiring and use the interview process to deliver malware to someone who already works somewhere valuable. BleepingComputer notes the resemblance to North Korean campaigns known as "Contagious Interview" and "Operation Dream Job". The opposite pattern, the **"fake candidate"**, is just as well documented. In June 2025 the US Justice Department announced coordinated actions against North Korean remote IT worker schemes. It said workers using stolen or fake identities had obtained jobs at more than 100 US companies, backed by shell companies with websites and bank accounts that made them look like legitimate contractors ([US DOJ](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote)). One case it described involved fake identities used to get hired at an Atlanta blockchain company, followed by the theft of about $900,000 in virtual currency. Both patterns rely on the same weakness. A hiring process is built to move quickly and to trust paperwork: a company profile, an offer letter, an ID, a degree, an employment history, a reference letter. Each one is a document that is cheap to fake and rarely checked. > **WARNING:** Document checks would not have stopped the malware in the Binance case. That needed endpoint and access controls. What they do stop is the identity layer these campaigns are built on: the invented company, the borrowed identity, the forged credential that gets someone a laptop and an account. ## What to verify, on each side of the hire ### When you are the candidate (or protecting your staff from fake employers) - **The company.** Does the registration certificate or incorporation record match a real entity in a public registry? A newly made "company" often has a template-built certificate with mismatched fonts or numbering. - **The offer letter or contract.** Check its metadata and signature. A letter claiming to come from an established firm but generated by a consumer PDF tool minutes before it was sent is a warning sign. - **The recruiter's credentials.** Fake HR personas often share screenshots of employee ID cards or LinkedIn-style certificates, which are easy targets for AI image generation. - **The assignment.** No document check covers this one. Never run take-home code on a work machine. ### When you are the employer - **Identity documents.** Passports, driving licences and national ID cards submitted remotely should be checked for template edits, photo swaps and AI generation, not just read by OCR. - **Degrees and certificates.** A fake degree is the easiest credential to buy. Check the issuer's layout, seals and the internal consistency of dates and grades. - **Employment and relieving letters, and payslips.** Cross-check company names, dates and salary figures across documents. A shell company's letterhead often won't match its own website or registration. - **Consistency across the bundle.** One forged document can look perfect alone. Names, dates of birth and addresses that disagree across an ID, a degree and a payslip are much harder to fake consistently. ## Where TamperCheck fits TamperCheck checks the documents a hiring process depends on, for both sides of the hire: identity documents, degrees and transcripts, employment letters, payslips, offer letters and company registration certificates. Each upload gets [forensic analysis](https://tampercheck.ai/document-fraud-detection) for edits, AI generation, template mismatches and metadata problems, plus signature trust checks on signed PDFs. Cross-document checks then compare names, dates and figures across a candidate's whole bundle. It doesn't replace endpoint security, access control or a careful interview. It makes sure the paperwork that gets someone into the building, or gets your engineer to open an attachment, is what it claims to be. **Verify a candidate's documents**. Upload an ID, degree, payslip or offer letter and get a forensic verdict with the evidence behind it. (https://tampercheck.ai) ## FAQ ### How did the Binance hack start? According to Binance's 3 November 2026 incident report, a software engineer was approached on a job platform by someone posing as a project director at a fictitious company. After interviews with a fake HR representative and a fake CEO, the engineer downloaded a coding assignment containing custom malware. The attackers then moved through internal systems and stole about $6.3 billion on 29 October. ### Did Binance hire someone with fake credentials? No, not according to the published reporting. The attackers posed as a fake employer recruiting a Binance engineer; they did not get hired by Binance. Fake-candidate schemes, where North Korean IT workers get hired using stolen identities, are a separate and well-documented pattern. ### Who was behind the Binance hack? The FBI attributes it to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group. Binance's co-CEO acknowledged the FBI's attribution but did not make it himself, and North Korea has rejected the claim. ### How can companies detect fake job candidates? Check identity documents for photo swaps, template edits and AI generation. Check degrees and employment letters against the issuer's real format. Compare names, dates and figures across every document a candidate submits, and confirm employers and contractors exist in public registries. ### How can I tell if a recruiter or job offer is fake? Check that the company exists in an official registry, look at the offer letter's metadata and any digital signature, and be wary of ID cards or certificates shared as screenshots. Never run a take-home coding assignment on a work device. ## Sources - BleepingComputer, "Binance says fake job interview led to $6.3 billion crypto heist", 3 November 2026. [bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/) - CoinDesk, "Binance's $6.3 billion hack began with a fake job interview, exchange says", 3 November 2026. [coindesk.com](https://www.coindesk.com/business/2026/11/03/binance-s-usd6-3-billion-hack-began-with-a-fake-job-interview-exchange-says) - CNBC, "Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto", 3 November 2026. [cnbc.com](https://www.cnbc.com/2026/11/03/binance-co-ceo-teng-says-hackers-used-fake-job-interviews-to-steal-6point3-billion-in-crypto.html) - NBC News (Reuters), "Binance: Hackers used fake job interview before $6.3 billion hack", 3 November 2026. [nbcnews.com](https://www.nbcnews.com/business/markets/binance-hack-fake-job-interview-heist-rcna607238) - US Department of Justice, "Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers' Illicit Revenue Generation Schemes", 30 June 2025. [justice.gov](https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote)