New details surrounding the record‑breaking Binance hack have revealed that the attackers relied not only on technical exploits, but also on a sophisticated social‑engineering campaign built around fake job interviews.
According to Binance’s internal investigation, the operation began months before the theft and involved malicious software disguised as legitimate recruitment materials, compromised developer tools, and the abuse of internal systems.
The attack ultimately led to the theft of approximately $6.3 billion in digital assets, making it one of the largest cyber thefts ever recorded and highlighting the growing effectiveness of human‑targeted attacks against critical crypto infrastructure.
Single Breach Started after Months-Long Preparation
Binance’s investigation shows that the incident was not the result of a single mistake or isolated vulnerability. Instead, attackers spent months building access to key systems before launching the final theft.
Reuters reports that the operation began as early as June, when a member of Binance’s wallet infrastructure team downloaded a tampered version of a software tool from the internet.
The malicious software allowed attackers to gather information about the employee’s role and identify additional personnel connected to wallet operations.
Although Binance detected suspicious activity on the engineer’s device, replaced the machine, and rotated credentials, investigators later determined that attackers had already gathered valuable intelligence about the organizational structure of the wallet team. That information became the foundation for the next phase of the operation.
The attack depicts a growing trend among sophisticated cybercriminal groups: rather than attempting to break through technical defenses directly, they invest significant time in understanding internal processes, identifying key personnel, and exploiting human trust.
Recruitment Scam: How the Attackers Got In
The most striking aspect of the incident was the use of fake recruitment campaigns.
According to Binance, attackers approached a second engineer through a legitimate job‑search platform, presenting themselves as representatives of a technology company seeking new talent. The attackers then conducted multiple interview rounds, using fabricated identities, social‑media profiles, and recruitment materials to establish credibility.
The first stage involved conversations with an individual posing as a human‑resources representative. During these interactions, the attackers shared social‑media accounts and personal‑looking content to build trust. Once the target was comfortable with the process, a second interview was arranged with an individual claiming to be the chief executive officer of the fictitious company.
Near the end of the recruitment process, the engineer was asked to download a coding assignment as part of the hiring evaluation. The assignment contained hidden malware designed specifically to evade detection while granting attackers access to corporate systems.
Binance stated that the malicious repository was configured to execute unauthorized operations during installation and establish communication with infrastructure controlled by the attackers.
Hidden Malware and Internal Access
The malicious software deployed through the fake interview was crucial to the success of the operation.
According to Binance’s investigation, the malware used advanced obfuscation techniques and manipulated legitimate software components to avoid triggering security alarms.
Once installed, it enabled attackers to move laterally through internal systems, gather credentials, and establish persistence within Binance’s environment.
By October, the attackers had obtained sufficient access to begin targeting wallet‑related infrastructure. Reuters reports that on October 20, they leveraged previously compromised systems and internal resources to gain control over additional engineering environments connected to transaction authorization processes.
The gradual but carefully orchestrated progression portrays the discipline commonly associated with state‑sponsored threat actors, who often prioritize patience and operational security over speed.
