Somebody stole $6.3 billion from Binance, the world's largest crypto exchange, in about twenty minutes. It is the largest crypto theft in history — roughly four times the $1.5 billion Bybit theft that held the record before it. Ocean's Eleven needed a crew, a casino, and a vault. These folks needed a job-site message and a homework assignment. Binance's own incident report, published November 3, says the robbery took months to set up — and began the way a lot of trouble begins: with somebody looking for a better job.
Twenty minutes, ten blockchains
On October 29, the attackers swept funds out of Binance across ten blockchains. TRM Labs followed $6.36 billion of it; Chainalysis puts the figure near $6.4 billion. On October 31, the FBI publicly attributed the theft to TraderTraitor, North Korea's state hacking unit, linked to the Lazarus Group. North Korea denies it, through its state media. Experts quoted by Reuters describe TraderTraitor as the most capable financially focused hacking group in the world.
It started in June
In June, a Binance team member downloaded a tampered installer while setting up an AI coding tool. The installer was poisoned, and it gave them a foothold inside the company — just the warm-up.
The interview
In September, a Binance software engineer was job-hunting, like millions of people do every week. On a legitimate job platform, he was approached by a man posing as a project director. What followed looked like a normal hiring process, because it was built to. He interviewed by video with an HR representative who had social-media profiles and photos. He interviewed with the company's "CEO." The company did not exist. Neither did the jobs.
The final step of the process was a coding assignment, downloaded onto his work computer. Buried in it was malware — a poisoned copy of pyenv, a tool software engineers use daily. It escaped detection. It may be the most expensive homework assignment ever turned in. By the time the process "ended," North Korea's hackers weren't outside Binance's walls anymore. They were sitting at an employee's desk.
On October 20, they used that machine — together with a compromised AI tool inside the company — to reach the computers of two wallet engineers: the people whose machines could actually move the money.
October 29: the sweep
Using stolen credentials and an Ethereum feature called EIP-7702, the attackers authorized transfers and drained the funds in about twenty minutes. All the patience — June, September, October — was for those twenty minutes.
Binance says about $2.85 billion of it was frozen or intercepted, and that roughly 98% of affected assets have been replenished out of company funds, so customers won't take the loss. Withdrawals began returning in phases on November 1. The company also says it had already blocked 57 suspected North Korea-linked attempts this year. The fifty-eighth came dressed as a job offer.
Where the money goes
This is the part that makes it more than a crypto story. TRM Labs counts North Korea at 85 percent of all crypto-hack value stolen in 2026, and roughly $12.8 billion stolen since 2017. A Bloomberg Economics chart puts this one haul at about three-quarters of North Korea's estimated 2025 revenue. Analysts widely assess that this money funds the regime's nuclear and missile programs. One fake job interview, repeated at scale, is part of how a sanctioned weapons program pays its bills.
The scam is not just coming for crypto engineers
Strip the word "crypto" out and what's left is a script being run on job hunters everywhere — warehouse workers, office staff, mechanics, nurses — because it works on human beings, not job titles. The engineer in this story wasn't careless. He was outnumbered by professionals whose full-time job is being believable.
HOW THIS SCAM REACHES PEOPLE LIKE US — FIVE TELLS
- A real company does not make you install software from a stranger's link to get an interview. Legit hiring runs through the company's own systems, or none.
- An "assignment" that has to run on your work computer is the whole scam. Your work machine is the prize; the test is the wrapping.
- The rush is the tell. Flattery, fast scheduling, a "CEO" eager to meet a new candidate — real hiring is slow and boring.
- Profiles and photos prove nothing. The Binance engineer's interviewers had both — and they were actors for a company that didn't exist.
- If any step asks you to download something, stop. Look the company up yourself — a number or site you found on your own, not one they sent you — and check whether the process is real.
What happens next
Binance is restoring withdrawals in phases and says its customers are whole. The FBI's attribution is public, tracing firms are following the money, and Pyongyang's denial is on the record. The investigation will run for years. The lesson is already here, and it isn't about cryptocurrency: the most secure vault in the world still has people in it — and people answer job postings.
Sources: Binance incident report (Nov. 3, 2026); FBI attribution (Oct. 31, 2026); TRM Labs and Chainalysis analyses; Bloomberg Economics; Reuters; North Korean state media via Yonhap.
Got a NEWS TIP? Send it our way — stories, road closures, things we should cover, that's what we're here for. But a tip about a crime, an emergency, or a missing person goes to the POLICE first, always. We're the megaphone, not the police tip line.