Binance lost $6.3bn after a fake job interview. Are people really the weakest link?

What happened at Binance

On 29 October 2026, attackers took about $6.3bn in crypto from Binance, the world's largest crypto exchange. Blockchain analysts TRM Labs called it the largest hack in history, according to TechCrunch. The FBI has attributed it to North Korean state-backed hackers. This is Binance's account, as reported by BleepingComputer and CoinDesk on 3 November. Some details may still change.

1. A job approach. In September, a Binance software engineer was contacted through a legitimate job platform by someone posing as a project director at a company that didn't exist.
2. Two interviews that felt real. First a video call with a fake HR person, who shared a social media account full of personal photos to build trust. Then an interview with a fake “CEO”.
3. A move to chat. The second stage happened on a popular social chat app, where the engineer was asked to download a coding assignment from an online code repository.
4. One run of the test. The code installed new malware on the engineer's work computer. Binance says its endpoint security tools did not detect it.
5. Quietly spreading. By 20 October the attackers had used that computer, and an internal AI tool, to reach two engineers who worked on Binance's wallets. They took their logins and a token used to deploy software.
6. The theft. On 29 October they used those credentials to run their own code inside Binance's systems and send funds out.

Binance says customers won't be affected. It reports that about $2.85bn has been frozen or intercepted, and that it had replaced about 98% of the affected tokens from its own funds by 31 October. It has rebuilt the affected systems, replaced the compromised devices and revoked the stolen credentials.

So are people the weakest link?

It's the obvious headline: one engineer ran one file, and $6.3bn left the building. But “weakest link” is the wrong way to read it.

People are the most targeted link. Breaking into a well-defended company directly is hard. Persuading one person to open the door is cheaper, so that's where attackers spend their effort. This attack took weeks of patient work: a fake company, fake staff, fake social media, two rounds of interviews. That's not the sign of a weak person. It's the sign of a strong attacker.

People are also the only link that can notice. The malware was new, and the security software missed it. What could have spotted it was a pattern: a recruiter you've never met, a move off the platform onto a chat app, and a request to download and run something. Software can't see that pattern. A trained person can.

And the damage came from the systems, not just the click. A single laptop led to other engineers' machines, then to wallet logins, then to the money. Each step was a place where a limit could have stopped it. Blaming the engineer skips over all of them.

The honest answer: people are where most attacks start, so they deserve real training. But a business that relies on nobody ever making a mistake has already lost. You need people who spot the lure and systems that make one mistake survivable.

Not every breach starts with a person

The same month, the cloud hosting platform Railway was breached in a very different way. According to Railway's incident report, as covered by BleepingComputer, attackers used a previously unknown flaw in Railway's build system to break out of its isolation and steal an internal credential. Nobody was tricked. Railway says up to about 1.85% of its workspaces may have been affected, and stolen customer AI keys were used to run up about $740,000 in charges, which Railway says it will cover where providers won't refund them.

That matters for the “weakest link” debate. Technology fails too. Security works in layers, and people are one of them: often the first one an attacker tries, but never the only one.

Six lessons for small teams

Your business doesn't hold billions in crypto. But the trick used on Binance is the same one that reaches small teams every week, just dressed differently: a “quote request”, a shared document, an invoice, a freelance brief. These are the lessons that carry over.

1. “Download and run this” is the red flag

The whole attack hinged on one request: run this file. For most small teams it looks like “enable editing to see the invoice”, “install this to join the call” or “open the attached quote”. Make it a simple rule that nobody installs or runs anything sent by someone outside the business without checking first.

2. Trust built quickly isn't trust

Video calls, photos, job titles and a friendly manner were all part of the lure. Criminals put real effort into seeming real, and AI makes that cheaper every month. A convincing person is not proof of a real person. Our guide to social engineering training covers the levers they pull.

3. Watch for the move to another channel

The conversation started on a legitimate job platform, then moved to a chat app where there are fewer checks. “Let's continue on WhatsApp” or “text me on my personal number” is a classic step in scams aimed at businesses too, including business email compromise.

4. Keep work devices for work

The assignment was downloaded onto a work computer. Job interviews, side projects and personal downloads belong on personal devices. It's an easy rule to state, and it keeps an attacker's foothold away from your business accounts.

5. Limit how far one mistake can spread

In a small business, everyone often has access to everything. Fix the basics: multi-factor authentication on every account, separate admin accounts used only for admin tasks, access only to what each person needs, and a second person to approve payments, new payees and changes to bank details. Then one compromised laptop is a bad day, not the end of the business.

6. Make reporting fast and blame-free

Attackers spent weeks inside Binance before the theft. The sooner someone says “I think I clicked something”, the less time an attacker has. That only happens if people aren't afraid of being blamed. If it does happen, our guide on what to do after clicking a phishing link lists the first steps.

None of this needs a security team, just practice. Lureproof gives small teams a monthly hands-on assessment that includes a live-attack simulation, so staff rehearse spotting and refusing a lure before it's real. Teams on Google Workspace also get realistic practice emails, and a click turns into a 60-second lesson. It's free for up to five people, and our free security training is open to everyone.

Sources

• BleepingComputer: Binance says fake job interview led to $6.3 billion crypto heist (3 Nov 2026)
• CoinDesk: Binance's $6.3 billion hack began with a fake job interview (3 Nov 2026)
• TechCrunch: North Korean hackers blamed for stealing record $6.3B in Binance breach (30 Oct 2026)
• BleepingComputer: Railway breach leads to $740,000 in fraudulent AI charges (10 Nov 2026)

FAQ