A Fake Job Interview Cost Binance $6.3 Billion

The biggest crypto theft in history did not start with a clever attack on a blockchain. It began with a friendly video call from a “recruiter.”

Binance says North Korea-linked hackers spent months targeting its staff, and one fake job interview in September opened the door. By 29 October they were draining hot wallets, and most of about $6.3 billion left in around 20 minutes. Binance says users will not lose money. But the story holds lessons for every African engineer, founder and exchange. It also lands in a region where cybercrime losses have more than doubled since 2024.

Binance published its incident report on 3 November. It says its security team blocked 57 suspected North Korea-linked attempts this year. One campaign still got through. The attackers did not hack the exchange from outside. They went after the people who worked inside it.

The timeline shows how patient they were.

Now the numbers.

TRM says this is roughly four times the Bybit theft, which the FBI also pinned on North Korea. The FBI’s alert, issued on 31 October, blames a North Korean unit called TraderTraitor. TRM and Chainalysis agree. TRM adds that the thieves have been selling and swapping fast to outrun freezes. They still hold more than 420,000 ETH and 18,270 BTC. That is about $2.4 billion beyond the reach of any token issuer. Note that “98% replenished” means Binance has refilled the affected tokens from its own money. It does not mean 98% of the stolen coins have come back.

The technical part is worth understanding, even if you never touch a wallet. Binance’s hot wallets use a system called multiparty computation, where no single person holds the full key. The attackers did not need one. They reached the wallet-signing service, the part that approves transfers, and asked it directly. They got it to sign about 50 special messages under an Ethereum feature called EIP-7702. That let an attacker’s code take control of a hot wallet and move funds outside the normal withdrawal process.

That is why pausing withdrawals did not stop the theft. The permission lived on the blockchain, not inside Binance. And because there was no single key, cancelling it took a special procedure that, one security firm estimates, took nearly four hours. Halborn, the firm, notes that Binance has not yet explained why the signing service approved the requests. Nor has it said what the internal AI tool could reach. An independent review is still to come.

The human side is the part most readers can act on. Security firms link this style of attack to a North Korean campaign called Contagious Interview. The group poses as recruiters from AI, blockchain and crypto firms. It contacts people on job platforms and social media, then hands them a coding test or a call link. International authorities say it infected more than 30,000 devices in over 100 countries between December 2025 and July 2026. It also stole funds or logins from more than 7,000 crypto wallets. Binance did not name the campaign, but its description fits.

Why does this matter beyond Binance? Because Binance is where many Africans trade. It says it has more than 323 million registered users in over 100 countries. It stopped naira trading pairs in Nigeria in March 2024, though users can still reach their accounts. The Central Bank of Nigeria is also in legal proceedings against it. After the hack, Nigerian users asked a fair question. How many local firms could cover customer losses the way Binance says it will? Local rules are tightening. From January 2026, digital asset exchanges in Nigeria must raise capital to N2 billion, up from N500 million. They have until June 2027 or risk losing their licences.

The wider African picture is sharper still. INTERPOL’s 2026 African threat report says AI is involved in 55% of reported cybercrime on the continent. Losses more than doubled since 2024, from $192 million to $484 million. It names scams, stolen logins and automated social engineering as the main drivers. Put that next to Binance. This single theft is about 13 times all of the cybercrime losses INTERPOL counted across Africa. That sum is ours.

So what should African teams do now? The sources point to a short list of habits. Treat every take-home test and unknown code repository as untrusted. Run it only in a disposable virtual machine, never on the laptop that holds your work logins. Start the call yourself, and check a recruiter and their company through a separate channel before you accept an interview link. Be wary of any request to install software or run a command. Keep long-lived deployment tokens off laptops, and give each internal AI tool its own limited access. Make sure your wallet or payment system can cancel a permission quickly, and practise the drill. Finally, switch on multi-factor authentication and review login histories often.

Why it matters: Africa’s fintechs, exchanges and crypto start-ups hold other people’s money, and their staff are being hunted with convincing job offers. Binance has deep pockets and a large security team, and it still lost $6.3 billion to a patient attacker. A young African firm does not have that cushion. The lesson is that security is as much about people, tools and habits as it is about code. A founder who trains staff to spot fake recruiters, and who limits what any one laptop can reach, is doing more than ticking a compliance box. That founder is protecting customers’ trust.

What to watch next: the findings of Binance’s independent review, and whether it explains why the signing service approved the requests. Also watch how much of the roughly $2.4 billion in the thieves’ hands is frozen or recovered. And watch how Nigerian and other African regulators respond with new rules on exchange security. Another test is whether job platforms tighten checks on recruiters, since that is where the attack began.

Sources: Techpoint Digest, 4 November 2026, on Binance’s incident report; CoinDesk on Binance’s report that the hack began with a fake job interview; ITV News and AP on the $6.3B Binance hack; Let’s Data Science on the FBI’s TraderTraitor attribution; Halborn on the wallet-signing service and EIP-7702; SafeDep on the attack path; Help Net Security on North Korea’s Contagious Interview campaign; Forbes Africa on Binance resuming withdrawals; Tribune Online on Nigerian users’ reactions; AbokiForex on phased withdrawals and Nigeria; Tech Africa News on Binance’s 323 million users; INTERPOL African Cyberthreat Assessment 2026.

A note for startup founders: Don’t practice on investors. Practice on AI first. RaiseReady by Index Prima is an AI fundraising simulator for African founders: upload your pitch deck, get a readiness score and face a tough AI investor before the real meeting. Find this post, and every post we publish, at raiseready.indexprima.com.