FULL STORY

Binance's $6.3B Hack: From Rumors to Official Report

Binance disclosed a roughly $6.3B theft, the largest single hack ever, after a North Korea-linked fake-recruitment supply chain attack compromised an engineer's laptop. The exchange later released an initial investigation report detailing the attack chain.

2026-11-02 ~ 2026-11-04 · 2 episodes · 9 posts

Episode 1 · North Korean Hackers Behind $6.3B Binance Breach via Fake Job Interview (2026-11-02, 2 posts)

Binance disclosed that roughly $6.3 billion flowed out after a engineer's laptop was compromised. The FBI attributes the attack to North Korean hackers who posed as recruiters to trick the engineer into downloading malicious code.

Episode 2 · Binance Reveals $6B+ Hack Chain: Fake Interview and Trojanized Installer (2026-11-04, 7 posts)

Binance has released a preliminary investigation report on the major security incident of October 29, calling it the largest single theft in human history, with losses exceeding $6 billion (posts cite $6.34 billion specifically), carried out entirely through ordinary channels. The report reconstructs the full supply-chain attack from job-hunting trap to stolen funds, sparking broad discussion about developer security habits and AI-accelerated social engineering.

Confirmed

  • The attack's entry point was a job-hunting trap: a Binance software engineer who posted a résumé on a job site was contacted by someone posing as a "project director," given a video interview with a real person appearing as "HR," then tricked into downloading a tampered installer (several accounts mention a Homebrew package; AutismCapital's recap also says an engineer downloaded a fake AI coding tool from a bogus link on Google and was guided by the "fake interviewer" to download a virus-laden coding "assignment")
  • After the engineer's laptop was trojanized and compromised, the attackers gained access to Binance's internals; the attack spanned June through October and ultimately cost $6.34 billion — more than half of Monaco's GDP last year
  • The attack has been attributed to a North Korean hacking group

Unconfirmed

  • The version relayed by @gnukeith claims the breach originated from a homebrew install while a developer was "vibecoding" (casually writing code with AI), and puts the amount at $7 billion, conflicting with Binance's official $6.34 billion figure
  • Much of the report is redacted, so details about the specific internal vulnerabilities remain undisclosed

Why it matters

  • Evgeny Gaevoy commented that Binance rarely discloses incidents in such concrete detail, while bluntly saying the culpable "Engineer B"'s negligence was severe enough that no company should ever hire them again
  • @gnukeith raised a broader question: in a project with only two developers, how could one person have access to billions of dollars in permissions — exposing failures in access management
  • Sequoia partner Hossein emphasized in a repost: the internet is about to be flooded with AI-accelerated attacks like this, and the case is a major warning — the combination of social engineering and trojanized dev tools could hit any company