Binance Says Its $6.3 Billion Hack Began With a Fake Job Interview, but Traders Aren’t Convinced
Binance said on Tuesday, November 3, that the Binance hack started with a fake job interview, in which North Korean hackers gave one of its engineers a coding test laced with malware, but many traders still doubt that is the whole story.
The October 29 theft took $6.34 billion from Binance’s hot wallets, the largest crypto heist on record. Binance’s incident report describes a campaign that ran for months: a tampered download in June, the fake interview in September and an internal AI tool that led the attackers to the engineers who ran its wallets.
Not everyone is buying it. Since the hack, traders on X have called it an inside job. They point to how fast the money left, across ten blockchains in about 20 minutes, and to how often Binance’s account has changed.
No one has offered proof. The FBI has tied the theft to North Korea’s TraderTraitor group, and blockchain analytics firm TRM Labs agrees with high confidence.
BNB hasn’t recovered either. It trades at $703.33, up 0.7% today but still 7.4% below its $759.85 close the day before the hack.
So what exactly does Binance say happened, and why are traders still unconvinced?
How Does Binance Say the Hack Happened?
Slowly, through three engineers. Binance co-CEO Richard Teng told CNBC the attackers “spent months building their way in” and rejected the idea that a single laptop was the weak point.
The report lays out four steps:
- June: a Wallet DevOps engineer looking for an AI coding tool clicked an ad for a tampered copy of Homebrew, a common developer tool. Binance caught it, replaced the device and rotated credentials, but the attackers had already learned who ran its wallets.
- September: a second engineer, whose profile mentioned Binance, was approached on a job site by a fake “Project Director.” After a video call with “HR” and a chat with a fake CEO, they downloaded a coding assignment that planted malware security tools didn’t catch.
- By October 20: from that laptop, the attackers used an internal AI tool to take over two engineers on the wallet team. One had a container deployment token on their computer.
- October 29: the attackers used that token to deploy a malicious script, reach the wallet signing service and move funds out across several chains.
“This wasn’t one mistake or one breach – it was a months-long campaign,” Teng wrote on X.
Binance says users won’t lose anything. It has replaced 98% of the stolen assets with its own funds, and about $2.85 billion has been frozen or intercepted with the help of Tether, Circle and others.
Discover: Bitcoin Settles Its $10.9 Billion Options Expiry Right on Max Pain After the Binance Hack
Why Aren’t Traders Convinced by the Binance Hack Story?
Because the doubts started before the report, and the report didn’t settle them. Two days after the theft, trader Financelancelot called it “totally an inside job,” and Solana trader Ansem wrote: “My trust in binance is gone.”
The skeptics keep coming back to five points:
- The story changed: Binance first blamed one DevOps engineer’s laptop on October 29. A day later it found “additional breach points,” and the final version involves three engineers, four months and an AI tool.
- The speed: most of the money left across ten chains in about 20 minutes, all with valid signatures. Critics ask how a compromised laptop could reach that far.
- The June warning: Binance caught the first intrusion and rotated credentials, yet an engineer on the same team still held a deployment token in October, and the interview malware sat unnoticed for weeks.
- The money kept moving: on-chain data firm Bitquery found Ethereum transfers going out until 23:56 UTC, after Binance had paused withdrawals. The report blames 50 pre-signed EIP-7702 authorizations that let the attacker keep sweeping a hot wallet.
- The size of the hot wallets: $6.34 billion was sitting in wallets connected to the internet, and critics want to know why so much was exposed.
The proof of reserves didn’t help. Binance’s November 2 proof used an October 31 snapshot, taken after it had already bought back most of the stolen coins, so critics say it can’t show how big the hole was.
A hack of this scale means serious security failures occurred. No platform is unhackable, but that cannot be an excuse. Every incident exposes weaknesses that should have been prevented.
Some details are embarrassing. Public explanations also simplify what appears to have been a… https://t.co/ZMAjZt2hF8
— CZ
BNB (@cz_binance) November 4, 2026
Some of the louder claims have already fallen apart. A viral post blaming a North Korean “honey trap” passed 800,000 views before co-founder Yi He called it untrue and said ZachXBT, the investigator it quoted, never said it.
An employee’s laptop being the way in doesn’t make it an inside job. Fake job offers with booby-trapped coding tests are TraderTraitor’s best-known trick, the same group behind the $1.5 billion Bybit hack in February 2025.
Where Is the Stolen Money Now?
Less than half of it has been stopped. Of the $6.34 billion taken, Binance says $2.85 billion has been frozen or intercepted, much of it stablecoins that Tether and Circle could lock.
The rest is on the move. Blockchain analytics firm Elliptic counts about $3.24 billion still in addresses linked to the attackers, and Chainalysis has found the stolen funds mixed with money from September’s Bitget exploit.
One pile hasn’t moved at all. The 233.46 million XRP taken from Binance, worth about $299 million, has sat in six wallets since November 2, untouched as of Wednesday morning.
What Could Change Traders’ Minds?
More proof, and soon. Three things are due in the next few days:
- A second reserves snapshot: Binance planned one for today, covering more tokens. The zero-knowledge proof takes about 40 to 50 hours to generate.
- Withdrawals: they are coming back network by network, with more assets added since Tuesday.
- The independent review: outside security firms are checking Binance’s findings, though it hasn’t said when, or how much, it will publish.
BNB Price Analysis: Can BNB Get Back to Its Pre-Hack Level?
Not yet. BNB fell 8.1% on October 29, from $759.85 to $698.46, on $414 million in volume, more than four times what it traded the day before.
It has leaned on its 200-day EMA ever since. BNB dipped to $680.74 earlier today, close to the $680 hack low, and bounced back to $703.33.
The levels to watch:
- $727.73: the 50-day EMA, now sloping down
- $759.85: the October 28 close, the last before the hack
- $693.01: the 200-day EMA
- $680: the October 29 low
BNBUSDT 1D chart. Source: TradingView.
| Scenario | Condition | Where it could lead |
|---|---|---|
| Advance | A daily close above $727.73 | $759.85, the pre-hack close |
| Pause | Holding between $693 and $727.73 | Sideways until the next reserves proof |
| Retreat | A daily close below $680 | $674.60, the September 1 low |
Binance has told its version of the Binance hack in detail. Until the independent review backs it up, traders will keep reading BNB’s chart as a vote of confidence.
The post Binance Says Its $6.3 Billion Hack Began With a Fake Job Interview, but Traders Aren’t Convinced appeared first on Tokenist.
