ISLAMABAD, November 4, 2026: Cryptocurrency exchange Binance has detailed how hackers allegedly used fake job interviews and malicious software to gain access to engineers’ computers in connection with a reported $6.3 billion cryptocurrency theft.
According to a preliminary investigation report cited by Pakistani media, the attackers targeted two software engineers through fraudulent recruitment interviews, gaining access to their computers before allegedly using a third engineer’s device to carry out the theft.
The report said the attackers spent several months developing an elaborate scheme to deceive the company’s technical staff. The operation allegedly involved hackers linked to North Korea, although Pyongyang has denied responsibility.
The malicious software was reportedly concealed in fake job advertisements and recruitment-related materials designed to appear legitimate.
Binance said its security team had blocked 57 cyberattacks allegedly linked to North Korea during 2026.
The attempted intrusions reportedly involved fraudulent interviews, malware disguised as development tools, compromised software packages, malicious browser extensions and counterfeit video-conferencing applications.
The report also cited information from the US Federal Bureau of Investigation (FBI) attributing the attack to North Korean actors. North Korea has rejected the allegations.
According to the company, approximately $2.85 billion in assets have been frozen or intercepted as part of efforts to contain the financial damage.
Binance also said it had covered approximately 98% of the value of affected tokens using its own funds.
The cryptocurrency exchange maintained that customers would not be required to bear the financial losses resulting from the cyberattack.
Investigations into the incident remain ongoing.