Binance: The fake job interview that helped steal $6.3 billion

A heist that started far from the app

On October 29, 2026, Binance reported a theft of about $6.3 billion from its hot wallets. For users, the only visible sign was a temporary pause on withdrawals. But the problem didn't start in the app people use. According to the company, the attack ran through engineers' laptops and Binance's internal systems. The way in was employees and their work machines, not a glitch any customer could have spotted on their phone.

Hot wallets and the system that signs off

A cold wallet is like a safe with no internet connection. A hot wallet, on the other hand, stays online so money can move quickly, for example when someone withdraws funds. In this case, the hot wallets were the ones hit. Binance said the attack reached its internal infrastructure. That included a wallet signing service, the part of the system that gives the green light to a transfer before it goes out.

An installer, an interview, and a code folder

The attack happened in stages. In June 2026, an engineer on the Wallet DevOps team downloaded a tampered version of Homebrew, a popular Mac installer, to set up an AI tool. In September, another engineer fell for a fake job interview. He was asked to download a repository, basically a folder of code, which Binance described as malicious. On screen it looked like a normal test, but behind the scenes it helped the attacker move around the work environment. Then, according to Binance, the attacker used an internal AI service to reach the signing system and start transactions outside the normal withdrawal process.

A limited key and doors closed in phases

Binance added that the attacker took advantage of an Ethereum feature called EIP-7702. Put simply, it let him give a contract he controlled partial permissions over a hot wallet. The last unauthorized transfer was finalized on the public blockchain at 11:56 p.m. UTC on October 29. From there, Binance reopened withdrawals in phases, a process that continued until November 6.

What's confirmed and what's still unknown

Binance said it would cover the loss with its own funds. It also said deposits and other unaffected features kept working normally. There has been no public report that the master keys, or private keys, of the wallets were leaked. Some details remain unconfirmed: nobody has published who wrote the malicious software or the exact name of the internal AI tool. The company also didn't name a specific version of any affected user program.

Frozen assets and replaced systems

The reported figure was about $6.3 billion. To contain the damage, Binance said it froze part of the assets, revoked permissions and authorizations, and shut down the entry points the attacker had used. It also rebuilt or replaced the affected systems and laptops. The response went beyond the money itself: it also covered the work machines and internal services the attack had passed through.

Four things you can do today

1. 1. Open any job test or file from a stranger only on a separate computer.
2. 2. Download installers from the official website, never from links sent over chat.
3. 3. If an app asks for unusual permissions, stop and ask someone before you accept.
4. 4. Write down who can pause your business payments if something looks off.

What happened at Binance started with employees, not the app, and a trap like this can reach a small business too. Here are four simple steps for you and your team.