How Did Hackers Steal $6.3 Billion From Binance? One Fake LinkedIn Job Interview and a Poisoned Download

How Did the North Korean Hackers Get Into Binance?

They used two separate tricks, both aimed at engineers who handled company wallets. Binance described the steps in a report released on Tuesday.

1. A fake recruiter made contact. A person posing as a Project Director approached a Binance engineer through a legitimate job-hunting platform. The engineer’s profile mentioned experience at Binance.
2. Two fake job interviews followed. The first was with someone posing as an HR representative. The second was with someone claiming to be the CEO of a fictitious company.
3. An “assignment” carried the malware. The engineer was persuaded to download it, and that let the attackers into the company’s systems.
4. A poisoned download added more. Another engineer clicked an ad promoting a tampered version of Homebrew, a popular software package, instead of using the company’s regular channels. Binance says it detected and removed the fake download, but the attackers had already learned who managed the company’s wallets.

Together, the two tricks let the attackers take over a series of wallets and drain them.

Did the Binance Hackers Use AI or Deepfakes?

Not for the break-in, according to Binance. Many people first guessed that AI had been used, but the company’s account points to conventional phishing.

Binance’s report doesn’t say the fake interviewers used deepfake faces or cloned voices. It matters anyway: the same recruitment trick can be paired with a synthetic face or voice on a video interview, which is why deepfake detection methods are worth knowing.

Is that interviewer a real person? How to check a video for AI

If a “recruiter” insists on a video call or sends you a clip, ask yourself: is this video AI? An AI video detector (also called an AI video checker) analyzes a recording for signs of synthetic generation or face swaps. The same check works on clips from Instagram reels and posts and Facebook videos, where fake recruiter and investment scams also spread. Voice notes can be faked too, so an AI voice detector is worth using on audio messages.

How Common Are Fake North Korean Recruiters?

Common enough that Binance says it had already flagged earlier attempts. The company says it detected and prevented 57 North Korea–related hacking attempts in 2026.

• Fortune reports that hackers posing as recruiters have become a widespread problem across the corporate sector.
• A Binance spokesperson said employees in non-public-facing roles are not allowed to keep LinkedIn profiles. The spokesperson didn’t say whether the targeted engineer broke that rule.
• Binance paused withdrawals for about 48 hours and re-enabled them on Saturday.

How to Spot a Fake Recruiter: 5 Red Flags

1. The approach uses your employer. A message that cites your current company is built to look credible. Treat it as a target, not a compliment.
2. You can’t verify the company or the interviewers. Check who they are through independent sources before the second round.
3. A “test” or “assignment” needs a download. A real interview rarely asks you to run unknown files on a work computer.
4. Software comes from an ad. Install tools only from official channels, never from a sponsored search result.
5. You are on a video call with someone you can’t confirm. A synthetic face or voice is a risk, so confirm identity another way.

What if you think you’ve been targeted?

Don’t open the file. Stop talking to the recruiter, report the profile to the platform, and tell your security team if the contact reached you through a work device or work profile.

How Can You Protect Yourself From Fake Recruiters, Phishing Links and Deepfakes?

UncovAI wasn’t involved in this case, and Binance didn’t report deepfakes. But the tools match the tricks used, from a phishing link to a suspicious video call:

• Our AI scam and deepfake detector checks messages, images and media for signs of fraud and synthetic content.
• URL phishing detection checks a link before you click it, including links in ads and messages.
• Real-time deepfake detection for meetings flags synthetic faces and voices on video calls, such as a fake interviewer.
• Our AI video detector answers “is this video AI?” by checking a clip or a link, free to try.
• The deepfake Telegram bot lets you verify a video, photo or voice note without leaving Telegram.
• Our AI content detector covers deepfake, text and image detection in one place.

Comparing options? See the 10 best deepfake detection tools of 2026 and our guide to deepfake detection methods in 2026.

FAQ: The Binance Hack and Fake Recruiter Scams

Sources

• Fortune, “North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack,” by Jeff John Roberts, November 3, 2026, citing Binance’s report and statements to reporters.