Binance on Tuesday disclosed that North Korean hackers used a mix of social engineering and malicious software to pull off last week’s $6.3 billion heist, the biggest in crypto history. Speaking to reporters, company executives revealed that the hackers targeted a Binance engineer on LinkedIn and arranged a series of fake job interviews in order to persuade the employee to download an “assignment” that let them invade the company’s systems.
In a related report, Binance explained that: “Software Engineer B was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. Software Engineer B had a profile on the platform that referenced his experience at Binance. The purported Project Director arranged a first-round interview with a HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company.”
The report also provided additional details about a sophisticated months-long scheme that involved not only the fake LinkedIn recruitment, but also used a separate ad campaign that earlier tricked another engineer into downloading a malicious version of a popular software package called Homebrew.
According to Binance, the engineer in question did not download the Homebrew software though the company’s regular channels, but instead clicked on an internet ad promoting a tampered version of it.
Binance says it detected the fake Homebrew download and removed it from the employee’s machine, but not before the hackers discovered critical information about the engineer’s role and others who managed the company’s wallets.
It was the combination of these exploits—the fake LinkedIn outreach and the knowledge gleaned from the tampered Homebrew download—that allowed the North Korean hackers to take over a series of Binance wallets and drain them of funds.
According to a Binance spokesperson, employees with non-public facing roles are not allowed to maintain LinkedIn profiles. The spokesperson declined to explain if the engineer in question had violated that policy, or if either of the engineers would be terminated.
The phenomenon of North Korean hackers posing as recruiters has become a widespread problem across the corporate sector more broadly. In the case of Binance, the company said it flagged earlier efforts by hackers to target its employees on LinkedIn and that, in 2026, had detected and prevented 57 North Korea-related hacking attempts.
Since the attack, which occurred over several hours on Thursday, the company has disclosed that the hackers stole around $6.3 billion, but that it was able to recover around $2.5 billion of that after two companies, Tether and Circle, moved to freeze stolen stablecoins.
In response to the hack, Binance shut down withdrawals for around 48 hours, but re-enabled them on Saturday. The company has repeatedly stated that all customer funds are safe, and has replenished 98% of the stolen coins from reserve funds and other sources. It is in the process of acquiring the remaining 2%, which consist of lesser used currencies.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” said Binance in a statement.
The post North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack appeared first on Fortune.
