Binance update: a fake job interview planted the malware behind the $6.3 billion theft, and $2.85 billion is now frozen or intercepted
Binance said in an incident report published November 3, 2026 that the October 29 theft began with a fake job interview that tricked a software engineer into running malicious code, that the attackers then compromised two more wallet-infrastructure employees and reached its wallet signing service, and that about $2.85 billion of the stolen assets had been frozen or intercepted as of November 3, with 98% of impacted token assets replenished as of October 31.
What happened
We first flagged this on October 29, 2026 — here’s what changed. Update Nov 3, 2026: Added Binance’s incident report account of how the theft began — a fake job interview in September that planted malware on a software engineer’s device, a spread to two more employees by October 20, frozen or intercepted assets rising to about $2.85 billion as of November 3, and 98% of impacted token assets replenished as of October 31. In the report, published November 3 and covered by BleepingComputer, Binance said the attack began in September when a software engineer whose profile referenced his Binance experience was contacted through a legitimate job-hunting platform by someone impersonating a project director at a fictitious company. After two interviews — the second through a popular social chat application — the engineer was told to download a coding assignment from an online code repository; the repository contained malicious code that compromised his device with previously unseen custom malware that his endpoint protection did not detect. By October 20, the attackers had used the compromised computer and an internal AI tool to compromise two additional employees working on Binance’s wallet infrastructure, obtaining credentials and a container deployment token. On October 29 they used the stolen credentials to deploy a malicious script and reach Binance’s wallet signing service, and abused Ethereum’s EIP-7702 authorisation mechanism to keep transferring cryptocurrency even after withdrawals were suspended. Binance says it has rebuilt the affected systems, replaced compromised devices and revoked the stolen credentials, and has brought in independent security firms to review its findings.
Who is affected
The same customers as in the original report: Binance users worldwide whose balances sit on the exchange. No customer personal data has been reported taken in this incident, and this report does not change that — what was stolen was cryptocurrency from Binance’s own wallets. The newly described targeting was aimed at Binance employees, not customers: a software engineer picked out because his public profile mentioned Binance, then two colleagues on the wallet infrastructure team.
How serious
For customers, the money figures moved again: about $2.85 billion of the stolen assets had been frozen or intercepted as of November 3, up from the roughly $2.7 billion in our original report, and Binance says 98% of impacted token assets had been replenished as of October 31 — a different measure from the “95% covered” figure in our November 1 update, stated by the company at a different time. The method matters beyond Binance: a fake-recruiter interview ending in a “coding assignment” that must be run is a documented North Korean tactic (BleepingComputer notes the Contagious Interview and Operation Dream Job campaigns), and it targets individual workers in crypto and software jobs — anyone job-hunting in those fields can be approached the same way. The standing scam risk from our earlier reports is unchanged: fake support accounts and “expedite your withdrawal” offers follow incidents like this.
What to do now
If you are job-hunting in software or crypto, treat any interview task that asks you to download and run code as a red flag: verify the recruiter and the company through official channels you find yourself, and never run an interview assignment on a device that holds wallet keys, exchange sessions or work credentials. Binance customers need take no new step from this report — check balances and withdrawal status only inside the official Binance app or on the website you open yourself, and ignore any message offering to unlock, expedite or verify a withdrawal for a fee; no legitimate step requires a wallet recovery phrase or private key.
Sources: BleepingComputer, “Binance says fake job interview led to $6.3 billion crypto heist”, November 3, 2026 · Original report: Binance breach (October 29, 2026) · Previous update: Binance update (November 1, 2026)