Photo via New York Post

Binance says North Korean hackers conducted fake job interviews to hack engineer’s laptop in $6.3B heist

Read the original at New York Post ↗
Cite

Herzlich, T. (2026, November 3). Binance says North Korean hackers conducted fake job interviews to hack engineer’s laptop in $6.3B heist. New York Post. https://nypost.com/2026/11/03/business/binance-says-north-korean-hackers-conducted-fake-job-interviews-to-hack-engineers-laptop/

Dated from the outlet's own feed. Check the original for its byline.

New York Post · collected 2026-11-03 · by Taylor Herzlich

Quick Summary

Binance disclosed that North Korean hackers conducted fake job interviews with one of its engineers to steal access credentials and launch a $6.3 billion hack in October. The elaborate scheme began in June when an employee downloaded tampered software, and continued through September with phony recruitment activities that tricked another engineer into downloading malicious code. On October 20th, the attackers used compromised credentials to gain control over multiple engineers’ computers, ultimately launching the heist on October 29th. The FBI has linked the attack to North Korea's TraderTraitor group, though North Korean state media denies involvement.
Written by AI on 2026-11-03, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

As of November 4, 2026, Binance, the world's largest cryptocurrency exchange, confirmed a security breach resulting in the theft of over $9 billion. The company's investigation revealed that hackers used fake job postings and malicious code to carry out the heist. This incident has prompted stablecoin issuers like Circle and Tether to freeze more than $2.5 billion worth of assets to prevent further losses. Binance temporarily suspended all deposits and withdrawals while conducting security checks, claiming they would cover any losses.

Hours after the theft was confirmed, North Korea fired multiple missiles towards the sea off its eastern coast, following a rejection of US accusations that North Korean hackers were responsible for the cyber attack on Binance. The country's military stated it had tested new cluster warhead-equipped cruise missiles capable of destroying large areas.

Written for “North Korea Fires Missiles Over Hack Accusations” on 2026-11-04, grounded in this article and the 91 other(s) covering the same event.

Story

📰 North Korea Fires Missiles Over Hack Accusations
Politics · 92 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 8% of its claims. Each row says how that neighbour differs.
NPR
Hedges 1 of 18 claims Outlet record 60/100
The Sydney Morning Herald
Hedges 4 of 35 claims Outlet record 61/100
Dawn
Hedges 11 of 45 claims Outlet record 72/100
ABC News (AU)
Hedges 0 of 3 claims Outlet record 67/100
The Sydney Morning Herald
Hedges 7 of 28 claims Outlet record 61/100
New York Post
Hedges 1 of 13 claims Outlet record 66/100
NPR
Hedges 1 of 26 claims Outlet record 60/100
Al Jazeera
Hedges 5 of 41 claims Outlet record 60/100
BBC News
Hedges 2 of 23 claims Outlet record 66/100
NPR
Hedges 6 of 42 claims Outlet record 60/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
12
sentences that state something as happening or true
Uncertain
8%
1 of 12 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
66/100
New York Post's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
92
Politics
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-11-03 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

New York Post · 16794 article(s) · 36 correction(s) detected
Running correction rate · 36 correction(s)

Who wrote this

Taylor Herzlich
65 article(s) here · 0 carrying a prediction
🔮 “Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds.
🔮 A notorious North Korean hacking unit may have compromised a single Binance employee’s laptop to pull off the record-breaking $6.3 billion hack of the cryptocurrency exchange – indicating a potential inside job or a stunning AI-powered infiltration of the company’s software.
🔮 But it wasn’t enough to squash fears over its massive spending plans, as Amazon reaffirmed its 2026 capex forecast of $220 billion.
🔮 If the stock closes down more than 9.77% in Thursday’s session, it will be the worst reaction in the company’s 22-year history and the second-largest single-day loss of any stock.
🔮 The Federal Reserve held interest rates steady Wednesday, even as inflation data has been worsening – but the central bank is largely expected to issue a quarter-point hike in December.
🔮 “Maybe we don’t have the hard power.
🔮 Trump told reporters late Wednesday that “something one way or another” will “happen fairly soon” in Iran.
🔮 Ackman said he has some friends in the Democratic Party, like New Jersey Sen. Cory Booker – but that he can’t think of a single candidate who could win his vote in the 2028 presidential election.
🔮 “Everyone’s talking about ‘tokenize this, tokenize that, tokenizing securities,’” Cuomo – who suffered a brutal defeat to NYC Mayor Zohran Mamdani last year – told the Wall Street Journal earlier this month.
🔮 Defense stocks have plummeted over the past few weeks as investors grow convinced Dems will emerge victorious in the midterm elections – potentially thwarting President Trump’s plans for huge military spending.
Also by Taylor Herzlich
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 65 articles by Taylor Herzlich →

Topics

Binance Engineer A FBI North Korean TraderTraitor

Subjects

Binance ORG · 4× North Korean NORP · 2× TraderTraitor ORG · 2× Engineer B PERSON · 1× FBI ORG · 1× North Korea GPE · 1×

Narrative

Binance said its security team detected the malware and immediately replaced the device and all employee credentials – but the attackers had already learned of Engineer A and his related colleagues’ roles at the firm. In September, “Engineer B” was contacted through a legitimate job-search platform – where he had a profile including his experience at Binance – by a person posing as a project director at a company.
framing: assertive · carried by 1 article(s) · first seen 2026-11-03

Claims (12 extracted, 1 hedged)

North Korean hackers used an elaborate scheme to pull off their $6.3 billion hack of Binance last week, the crypto exchange said — approaching one of its engineers as a fake company and conducting a series of phony job interviews before hacking into his computer. asserted
exchange → use → computer
Initial findings from investigation of what experts have called the largest bank heist in history revealed that the record-breaking cyberattack was a much more complex process than previously known – starting back in June and involving ads for tampered software, stolen credentials and fake interviews. asserted
cyberattack → call → software
In June, hackers laid the groundwork for their attack when an employee at Binance, referred to as “Engineer A,” downloaded tampered software found online that had been disguised and advertised as a popular AI coding tool. asserted
that → lay → tool
Binance said its security team detected the malware and immediately replaced the device and all employee credentials – but the attackers had already learned of Engineer A and his related colleagues’ roles at the firm. In September, “Engineer B” was contacted through a legitimate job-search platform – where he had a profile including his experience at Binance – by a person posing as a project director at a company. asserted
he → say → company
He completed a first-round interview with someone posing as an HR representative, who shared photos and videos from a social media account to make themselves appear legitimate, the company said. asserted
company → complete → account
Toward the end of a second-round interview with a person pretending to be the CEO of a fake company, Engineer B was instructed to download an “assignment” onto his work computer that actually contained malicious code – setting off a chain of unauthorized activities. asserted
that → pretend → activities
On Oct. 20, the attacker used the compromised computer and an internal AI tool to gain control over Engineer A and another Engineer C and discovered that Engineer A had a deployment permission token – a specialized credential – on his computer. asserted
A → use → computer
The hackers then used the credentials stolen from Engineer A to launch the massive attack on Oct. 29, draining billions of dollars from crypto wallets within 20 minutes and quickly spreading the riches across global networks. asserted
hackers → use → networks
On Saturday, the FBI linked the notorious North Korean state-backed cybercrime group TraderTraitor to the heist. asserted
FBI → link → heist
TraderTraitor is known for quickly laundering stolen booty across vast crypto networks, making it virtually impossible to recover. asserted
it → know → networks
North Korea has denied any ties to the attack, calling the accusation a “grave political provocation,” according to state-backed media. uncertain
Korea → deny → media
This is a developing story. asserted
This → develop → ?
💬Give feedback
🕘History 🎫Support