Skip to content
NewA calmer, faster ZeroHour
StoryData breachcriticalExploited in the wild

North Korean Hackers Steal $6.34B from Binance via Fake Job Interview

5 sources · 5 articlesFirst reported Updated ()1
What's new

November 3: New reports detail September fake job interviews, pyenv malware replacement, container deployment on another engineer's computer, and $2.85B frozen.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

North Korean hackers stole $6.34 billion from Binance on October 29 using fake job interviews and AI tools, with $2.85 billion frozen.

North Korean hackers from the TraderTraitor group stole $6.34 billion from Binance on October 29, 2026. They gained access through a September fake job interview that installed malware on an engineer's laptop, later using an internal AI tool and Ethereum EIP-7702 delegation to redirect wallet signing. Binance absorbed the loss from its SAFU reserve, replaced 98% of impacted tokens by October 31, and some funds were frozen by the industry.

Key facts
  • FBI attributes theft to North Korea and TraderTraitor group
  • Malware installed via fake job interview in September 2026
  • Used internal AI tool and EIP-7702 delegation on October 29
  • $2.85 billion frozen or intercepted as of November 3
  • Binance will absorb loss and replaced 98% tokens by October 31
  • Transfers included 233.46 million XRP, 970,500 SOL, 44.2M OP and 18,270 BTC
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Attackers used internal AI tool and EIP-7702 · Cyber Security News
  2. Oct 29, 2026Funds transferred including XRP, SOL, OP and BTC · Cyber Security News
  3. Oct 30, 2026Binance cleared delegation by authorizing zero address · Cyber Security News
  4. Oct 31, 2026Replaced 98% of impacted tokens · Cyber Security News
  5. Nov 3, 2026$2.85 billion frozen or intercepted · BleepingComputer

What each outlet adds

beyond the shared facts
  • Cyber Security NewsDetails on wallet transfers, nonce matching, and SAFU reserve loss absorption
  • BleepingComputerSeptember fake job interview process and pyenv executable replacement
  • TechCrunchMonths-long social engineering campaign and security tools failure
  • The RegisterContainer deployment on another engineer's computer and credentials decommissioned
Vendors
Binancebinance
Products
crypto exchange
Threat actors
TraderTraitorDemocratic People's Republic of KoreaNorth KoreaLazarus Group
Malware
MacSync Stealer
Victims
Binance
Organizations
FBI
Countries
North KoreaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 12h ago Cyber Security NewsFirst report

    Fake job task and hijacked AI tool in $6.34 billion Binance theft

    Attackers used a stolen deployment token and EIP-7702 delegation; about $2.85 billion was frozen or intercepted.

  2. · 9h ago WIRED · Security

    Binance hack attributed to North Korean group steals $6.34 billion

    Hackers compromised engineers through fake job interviews to access wallet signing service and move funds across blockchains.

  3. · 9h ago TechCrunch · Security

    North Korean hackers steal $6.3B from Binance

    Hackers used fake recruiter contacts to trick an engineer into downloading malware, stealing $6.3 billion in crypto.

  4. · 8h ago BleepingComputer

    Binance loses $6.3 billion in fake job interview malware attack

    North Korean hackers used fake job interviews to install custom malware and steal $6.34 billion from Binance's wallet infrastructure.

  5. · 6h ago The Register · Security

    North Korean hackers used fake job interview to breach Binance

    Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.