North Korean hackers steal $6.3B from Binance via fake job interview

A multi-stage North Korean cyberattack combining fake job interviews, malware, a supply-chain compromise of a Homebrew install, and misuse of Binance's internal AI tooling allowed attackers to steal credentials and deploy a container that triggered a $6.3 billion cryptocurrency theft on October 29, 2026.

Occurred 29 October 2026 · Disclosed 3 November 2026 · Record updated 3 November 2026

Impact

Theft of $6.3 billion in cryptocurrency from Binance's wallet infrastructure after attackers compromised employee devices, stole credentials, and abused internal AI tooling to gain deeper access.

Our coverage

Incidents

Fake job interview preceded $6.3bn Binance crypto theft

Binance says attackers chained a poisoned Homebrew install, a malware-laced coding assignment and its own internal AI tool to drain funds on 29 October 2026.

3 Nov 2026

Sources

theregister.comhttps://theregister.com/security/2026/11/03/north-korean-fake-job-interview-led-to-63b-binance-heist/5307398