# Binance hackers spent months planning $6.34bn theft

> North Korean actors used fake job interviews and malware to compromise Binance engineers and steal billions in cryptocurrency.
- Title: Binance hackers spent months planning $6.34bn theft | Shortify
- Summary: North Korean actors used fake job interviews and malware to compromise Binance engineers and steal billions in cryptocurrency. North Korean hackers stole six…
- Keywords: binance, cryptocurrency theft, north korea, malware, social engineering, cybersecurity, fbi, trm security, Ars Technica
- Source: Ars Technica — https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist
- Published: 2026-11-04T16:06:03+00:00
- Read time: 2 min
- Topics: binance, cryptocurrency theft, north korea, malware, social engineering, cybersecurity, fbi, trm security, technology, science
## Binance hit by record crypto theft
Hackers stole six point three four billion dollars from Binance, the largest sum ever targeted in a cryptocurrency theft. The FBI and TRM Security attributed the attack to North Korean actors.
## Exchange recovers two point eight five billion
Binance froze or intercepted two point eight five billion dollars of the stolen sum. The company said it has set aside funds required to cover the loss.
## Months of planning and preparation
The attackers began no later than June and continued until last Thursday. Binance said the threat actor was sophisticated and resourceful, combining social engineering, malicious software, and advanced techniques.

> It was not a single isolated breach or a simple phishing incident.
## First compromise via tampered Homebrew
In June, an engineer downloaded a tampered version of Homebrew. After malware operators obtained information about the engineer's role on the Binance wallet infrastructure team, the compromise was detected.
## Fake job interview delivers malware
In September, a second engineer received messages through a job-hunting platform from someone posing as a project director.During interviews conducted over video and chat, the engineer was instructed to download an assignment containing malicious code.
## Malware evades security detection
The malware used sophisticated obfuscation and evasion techniques, replacing a legitimate development tool component with a malicious version. The zero-day malware was not detected by endpoint security protection tools at the time.
## Attackers drain multiple wallets
On October twenty-ninth between seventeen fifteen and nineteen fifty-six UTC, attackers logged into a third engineer's device and initiated transfers.
## Ethereum mechanism exploited for access
The attacker used Ethereum's EIP-seven thousand seven hundred two authorization mechanism to give an attacker-controlled smart contract partial execution rights over a Binance hot wallet without exposing the private key.
## Binance contains damage with complex revocation
Binance suspended withdrawals and coordinated with partners to freeze affected tokens. Because the hot wallet used Multi-Party Computation, the team developed a specialized procedure to revoke malicious on-chain authorizations, requiring additional time and technical complexity.
## Key takeaway

North Korean hackers stole six point three four billion dollars from Binance through a months-long campaign using social engineering and novel malware; the exchange recovered two point eight five billion dollars.