Binance Security Chief Warned of Hacking Method Three Months Before Attack

Back in July 2026, Binance's Chief Security Officer Jimmy Su warned about the threat of fake interviews that allow hackers to infiltrate developers' computers. He told Cointelegraph how a test assignment with malicious code could be used to steal credentials. In September, a similar scheme was used in preparation for the Binance hack, which on October 29 affected crypto assets worth $6.34 billion.

How a Fake Interview Helped Hackers

According to Binance's investigation, an engineer received a job offer through a legitimate recruiting platform and underwent two interviews with representatives of a fictitious company. He was then asked to download a repository with a test assignment onto his work computer. During the setup, malware was launched, which masked its actions and went undetected by security measures. Su previously explained that individual steps of such a procedure appear legitimate and may not raise suspicions with antivirus software.

How the Attack Unfolded and What Binance Changed

The engineer's compromise was part of a multi-stage operation: in October, the attackers used an internal AI tool and other employees' credentials to infiltrate the cryptocurrency wallet infrastructure. According to Binance, on October 29, they initiated unauthorized transfers, and by November 3, about $2.85 billion in assets had been frozen or intercepted. The exchange promised to cover clients' losses with its own funds and reported that 98% of the affected token assets were restored by October 31.

Even before the incident, Binance conducted monthly phishing resilience checks on employees and, in 2026, it estimated that it had prevented 57 suspected cyber threats related to North Korea. After the breach, the company replaced compromised devices, updated wallet systems and the internal AI tool, and strengthened access control. The investigation is ongoing, so the final assessment of the attack's impact may change.