Binance Says Fake Interviews Enabled $6.3 Billion Theft

What changed

Binance says attackers stole $6.3 billion by combining a tampered installer, a malicious Google ad, fake recruitment interviews and malware.

The campaign allegedly unfolded over several months:

• In June, one developer downloaded a tampered installer after encountering a malicious Google ad.
• In September, another engineer was approached through fake hiring calls, multiple interview rounds and social-media exchanges designed to build trust.
• The engineer was then prompted to download a fake interview assignment that delivered malware.

Why it matters

The striking part is how ordinary the entry points were. The attackers allegedly did not need one spectacular technical exploit. They used the tools around engineering work: software installers, online advertising, social profiles and recruitment processes.

That makes hiring itself part of the security perimeter. A convincing interview process can create the trust needed to turn a routine coding assignment into an intrusion. Likewise, a developer workstation can become exposed before anyone realizes that an installer or advertisement was tampered with.

For companies, the practical lesson is uncomfortable: security checks cannot stop at production systems. They also have to cover how developers install software and how candidates receive interview materials. The reported attack path has not been independently confirmed here, and the attackers’ identities and full recovery outcome remain unclear.