Fake Interview, $6.3bn Gone: Binance Heist Redraws HR Risk

A fraudulent recruitment process gave North Korean hackers their entry point into Binance, and the resulting theft of US$6.3 billion on 29 October now stands as the largest cryptocurrency heist on record. The world's largest crypto exchange published its initial incident report this week after the US Federal Bureau of Investigation attributed the attack to North Korea. For HR leaders, the uncomfortable detail is this: the attack targeted an employee trying to leave, not a candidate trying to get in.

"This was not a single mistake or a single breach. It was a campaign built over many months," said Richard Teng, co-chief executive officer of Binance.

How did the attack unfold?

According to Binance, the operation began in June 2026, when an engineer on its wallet development team downloaded a tampered software tool that exposed the roles of that engineer and their colleagues. In September, a different engineer — privately job hunting on a legitimate platform — was approached by fake recruiters.

Ben Jones, cyber security practice lead at Coder Trove, said the sequence followed a familiar playbook. "Binance's incident report reads like a textbook on DPRK recruitment tradecraft," he told HRD.

The stages, as Jones described them:

• A first-round interview with a fake HR representative on live video, backed by a social media profile filled with personal photos and videos to appear genuine.
• A second round with a fake CEO over a chat app, where the engineer was told to download a coding assignment from a code repository.
• The assignment itself was the malware — custom, previously unseen, built to swap out a legitimate developer tool and quietly take commands from the attackers. Endpoint protection never detected it.

"Each stage was designed to lower the engineer's guard a little further, so by the time the assignment landed, trust had been built over weeks and the download felt routine," Jones said.

On 20 October 2026, attackers used the compromised computer plus an internal artificial intelligence tool to take control of two wallet developers' systems. Nine days later they moved 233.46 million XRP tokens out of five internet-connected "hot" wallets in four minutes. Binance said about US$2.85 billion of the stolen assets has been frozen or intercepted. Per the BBC, 98 per cent of affected token assets had been replenished as of Saturday.

"This should not have happened, and we apologise for the concern, disruption and uncertainty it caused," Binance said. North Korea has rejected the FBI's finding; Kim Yo-jong called the US claim "absurd rhetoric and nothing new", according to The Guardian's report of KCNA comments.

Is this tactic new?

No. Palo Alto Networks has named the approach "Contagious Interview". In 2022, a fake job offer to an Axie Infinity engineer preceded a US$590 million theft, Bloomberg reported. North Korean operatives more commonly pose as job seekers rather than recruiters: Recorded Future research found one cluster applied to jobs at more than 1,100 companies, and HRD's October 2026 report documented a New Zealand business that hired a North Korean remote IT contractor who later threatened to leak sensitive data.

Jones said Coder Trove briefed Australian and New Zealand cyber and HR leaders on both tactics on 27 October — two days before the Binance attack — with Dan Elliott, field chief information security officer for Asia-Pacific at Recorded Future.

What changes for HR?

The breach bypassed Binance's own hiring process entirely. The engineer was job hunting privately, as many employees do. Jones rejected framing the heist as a technological marvel: "Binance's own account shows the critical step was a software engineer trusting a recruiter across two interviews."

Binance detected and blocked 57 suspected North Korea-linked threats in 2026. Jones said that record should alarm smaller employers: "For an Australian business with no dedicated security team, the odds are considerably worse."

His prescription sits with HR and hiring managers: verify identity continuously, treat unsolicited recruiter contact to engineers as a security event, and never let a candidate or interviewer run code on a corporate device.

Binance is now investing in AI-enabled threat detection, commissioning a third-party review and planning a security research fund, while covering customer losses. The lesson for people teams predates the fix: the next breach may begin not in your ATS, but in an employee's private inbox.