Binance says its $6.3 billion hack began with a fake job interview, and North Korea denies involvement

Binance said on Tuesday that North Korea appears to have used a fake job interview as part of months-long preparations to steal $6.3 billion from the exchange². Binance said one of its software engineers was contacted in September through a “legitimate job-hunting platform” by someone posing as a project director at a fictitious company².

According to Binance, the engineer was invited to bogus job interviews with fake company representatives¹. During the first-round interview, a fake HR representative conducted a live video call with the engineer and showed off a seemingly legitimate social media profile². Binance said the hackers had plotted the heist for months⁴, and it released a report on the attack^9,11.

North Korea denied being behind the record theft^3,6. It rejected the US allegations over the Binance theft and warned of a response⁷. US government agencies and cyber analysts have blamed Pyongyang for the heist³.

Why it matters to investors

The account shifts attention from the exchange’s systems to its people. The attack, as Binance describes it, began with a single engineer targeted through a real recruiting platform^2,10. Hackers posing as recruiters and as job applicants to infiltrate companies is a tactic the coverage attributes to North Korea’s hackers².

The two sides’ claims conflict. Binance’s account points to North Korea², and US agencies blame Pyongyang³, while North Korea denies any role^6,8. Attribution matters for any sanctions response and for efforts to trace the stolen funds.

Binance’s finances so far appear to be holding up. Founder Changpeng Zhao said the exchange covered the $6.3 billion hack entirely from its own balance sheet, with no loans and no asset sales¹². He said on Tuesday that Binance is experiencing net hourly inflows¹³. The exchange’s BNB token rebounded above $700 as Binance recorded net inflows after the hack¹³.

What to watch

Zhao said Binance needs other cryptocurrency exchanges to block suspicious transactions¹¹. Whether rival platforms freeze funds linked to the theft will help decide how much of the stolen money can be traced.

North Korea’s warning of a response⁷ adds a diplomatic element. The next statements from US agencies on attribution³ will be watched alongside any further detail from Binance’s report¹¹.

Zhao, who served four months in federal prison and later received a pardon from President Donald Trump⁴, remains the exchange’s most prominent public voice on the recovery^12,13.