How the Binance hack began: a fake download and a fake job interview

When we reported on the 29 October Binance hack, one question was still open: how did the attackers get in? On 3 November Binance published its first detailed account. By that account, the attack didn't begin with broken code. It began with a fake download and a fake job interview. Here is what Binance says happened, and what anyone can take from it.

Key points: how did the Binance hack begin?

• Binance calls it a "months-long campaign", not one mistake by one person.
• In June, an engineer searching for a popular AI coding tool downloaded a tampered version.
• In September, fake recruiters gave another engineer a coding test with hidden malware.
• The attackers then moved across staff computers until they reached the system that approved wallet transactions.
• This is mostly Binance's own account. An outside security firm is reviewing it.
• The same tricks are used on ordinary people: fake downloads, fake offers and misplaced trust.

How did the attackers get in?

At first, Binance said the incident "may involve a compromised DevOps engineer's laptop". Its co-CEO, Richard Teng, now rejects the idea of one weak point, saying the attackers "spent months building their way in". According to CNBC and The Record, Binance describes four stages:

• June: a fake download. A Binance engineer downloaded a tampered installer "to install a popular AI coding tool after searching for it on a search engine". Binance noticed, replaced the computer and changed the login details. But it says the attackers had already learned about the engineer's role and colleagues on the wallet team.
• September: a fake job interview. Attackers "posed as recruiters and ran a series of job interviews with another engineer", Teng told CNBC. It ended in a coding exercise containing "hidden malware designed to evade security".
• By 20 October: moving inside. The attackers spread to other staff computers, The Record reported. Teng says they went through internal AI tools to reach "the system that authorized our wallet transaction".
• 29 October: the theft. An internal wallet signing service was used for the first transfers, The Record reported, followed by a $1.4 billion bitcoin transfer and 50 other transactions. Binance counts the total at $6.34 billion.

Binance said earlier that it had found no evidence that wallet private keys leaked. A private key is the secret code that controls a wallet. So, on this account, the attackers didn't need to steal the keys. They got into the system allowed to use them.

What is still not known?

Most of this comes from Binance itself. It says it has rebuilt the affected systems and hired a security firm to review the incident, and that review hasn't been published. The FBI says North Korea was responsible. North Korea denies it, and Teng has not named an attacker himself. Binance says it has replaced 98% of the affected assets with its own money.

Why does this matter if you aren't an engineer?

You don't run a wallet system. But the first steps of this attack would work on almost anyone, because they target habits rather than technology:

• Trusting a search result. The US Federal Trade Commission (FTC) warns that scammers "place bogus ads for software on social media sites and on search engines".
• Trusting an opportunity. A job offer, a test task or an investment tool can all be a reason to open a file you would otherwise ignore.
• Trusting someone over time. Not every scam rushes you. These attackers held a series of interviews first.

How can you spot a phishing email or message?

Phishing means a message pretending to come from someone you trust, so that you click, pay or share a secret. Advice from the FTC and the US cyber agency CISA comes down to these signs:

• Pressure: urgent language, or dire consequences if you don't respond right now.
• A request for secrets: your login, payment details, personal data or a code.
• An odd address: a sender or link with one letter changed, or a shortened link.
• A surprise: an account problem, invoice, refund or prize you weren't expecting.
• An attachment you didn't ask for: the FTC warns these may install malware, software built to do harm.

Good spelling proves nothing: CISA notes that AI can write polished messages. And in the FTC's words, "legitimate companies won't email or text with a link to update your payment information."

What should you do, and not do?

• Download from the source. Use your phone's official app store, or type the website address yourself. Don't click ads for software.
• Don't open or run files from strangers, even for a job test, a "handy tool" or a shared investment spreadsheet.
• Check through a second route. If a message might be real, ignore its links and numbers. Open the official app, or find the contact details on the official website.
• Keep your devices updated, and set security software to update automatically.
• Use a different password for each account and turn on two-factor authentication (2FA), a second check beyond your password. CISA urges "phishing-resistant" versions.
• Never share your recovery phrase, private keys or one-time codes. Nobody genuine needs them.

What if you already clicked?

Move quickly, and don't be embarrassed: these tricks fooled professionals. The FTC's malware advice is to:

1. Stop logging into online accounts.
2. Update your security software, or install some.
3. Run a scan and remove what it finds.
4. Change your passwords and turn on 2FA.

If a crypto account may be affected, contact the provider through its official app or website. Be wary of anyone who offers to get your money back: the FBI's IC3 calls such offers "a ruse to revictimize those who have already lost money".

What should you ask any crypto provider?

Whether you use a company or hold your own keys, attacks aim at the people and systems around the keys. Before you trust a provider, ask:

• Who holds the keys: this company or a separate custodian?
• How much is kept online, and who can approve a withdrawal?
• Is it authorised where you live, and by whom?
• What happens to your money after a hack or a bankruptcy?

No answer removes the risk. In the 2025 Bybit hack, attackers came in through a developer's computer at an outside wallet-software supplier. Using another company moves the risk; it doesn't end it. Our explainer on where an exchange keeps your crypto goes further.

What to take from this

The analytics firm TRM Labs calls this the largest crypto theft on record. By Binance's account, it started with a search result and a job offer. The defence is rarely clever: slow down, check through a second route, and never run or share what a stranger sends you.

What you can do now

• Build everyday habits in our introduction to security.
• Practise on real examples in spot the scam.
• Learn how wallets and keys work in storing cryptocurrencies.

Questions readers ask

Was the Binance hack caused by one employee?

Binance says no. It describes months of work across several engineers' computers, plus internal tools, and hasn't blamed any individual.

Are job scams a risk for ordinary people?

Yes. Anyone who is asked to install software or open a file for a "test task" should check the company independently first.

Is good spelling a sign that a message is real?

No. CISA warns that AI can produce polished messages, so check the sender and the request instead.

Crypto prices can rise and fall sharply, and you could lose some or all of the money you put in. Crypto is not covered by deposit protection. This article is for education, not financial advice.