Skip to the story
All StoriesPoliticsConflict & SecurityBusiness & EconomyScience & TechHealthClimateMedia
All stories
Business & Economy298 outlets ran this4 min read

Binance Hackers Stole $6.3 Billion After Fake Job Interview

Attackers compromised two engineers' computers over several months before draining crypto assets.

AI-assisted coverage comparison, editor-supervised · How this was made

Published
Graphic image of a North Korean cyberattack threat / gettyimagesbank

What this story says

  • Hackers stole $6.3 billion in cryptocurrency from Binance using a sophisticated, multi-stage attack that began in June.
  • The breach was initiated when an employee downloaded tampered software from an advertisement, followed by a second engineer being duped by a fake job interview.
  • The FBI has attributed the attack to a North Korean hacking group, a claim North Korea has denied.
  • Binance is repaying all affected customers and is increasing investment in AI-enabled security detection.

Who covered it

Left 30%(41)Centre 35%(48)Right 35%(42)

Percentages are shares of the 131 outlets carrying a published leaning rating. 167 of the 298 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .

Trust

60/100

Craft

65/100

Hype

45/100

298 sources · methodology

Hackers compromised computers belonging to two Binance software engineers, ultimately draining $6.3 billion worth of cryptocurrency in a record heist. The exchange detailed that the attack was a multi-stage operation that began in June and culminated in the theft on October 29. Even after Binance detected the attack and began to freeze withdrawals, hackers continued to move assets for nearly four hours.

The FBI has blamed a North Korean hacking group for the attack, a claim that North Korea has rejected. Binance has stated it is repaying all customers whose funds were stolen. The incident has raised questions about the security of digital assets and the vulnerability of large cryptocurrency exchanges to cybercrime.

How the attack unfolded

According to Binance's report, the attack began in June when an employee on the wallet developer team downloaded a tampered tool from the internet, disguised within an advertisement that appeared higher in search results than the legitimate version. Although Binance detected this and took measures, the employee's access was exposed. In September, a second software engineer, seeking a new role, downloaded malicious code onto their computer after interviewing for a position with a fictitious company. On October 20, attackers used the compromised computers and an internal AI tool to gain control of the systems of two wallet developers. Nine days later, on October 29, the attackers used the second engineer's computer, along with stolen credentials, to trigger a malicious script and launch the theft. The exchange reported that 233.46 million XRP were removed from hot wallets in four minutes, followed by other cryptocurrencies including bitcoin.

Disagreement on frozen assets

Binance stated that its actions to suspend withdrawals and freeze affected tokens resulted in approximately $2.85 billion of frozen assets. However, the digest from Crypto Economy states that of the approximately $6.3 billion stolen, the company claims to have frozen nearly $2.85 billion.

What the coverage left out

None of the left-rated digests mention Binance's claim that it had replenished 98 percent of the affected assets by drawing on its own funds. None of the centre-rated digests mention the FBI's claim that it has blamed a North Korean hacking group. None of the right-rated digests mention that Binance is repaying all customers whose funds were stolen.

Tags:#BinanceHack#Cybersecurity#Cryptocurrency#NorthKorea#Heist

Still developing. We have re-checked which outlets are covering this 152 times, most recently on 5 Nov 2026, 09:30, and will add the sides that appear.

How each side covered it

Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.

Left

41 rated outlets

  • Left-rated reports led with the method of the attack, highlighting the fake job interview and malicious software. Multiple reports mentioned the FBI's attribution to a North Korean hacking group, with The Korea Times noting that North Korea has rejected this claim. The Korea Times and PC Mag detailed the multi-stage nature of the attack, including the compromised advertisement and the fake job interview. The Korea Times also included a quote from Binance apologising for the incident and mentioning the exchange's detection of 57 suspected North Korea-linked cyberthreats in 2026. Wired noted that the hackers used 'well-known tricks'.

Centre

48 rated outlets

  • Centre-rated reports focused on the details of the hack, including the fake job interview and the compromise of employee computers. Channel News Asia and Times of Malta highlighted that the attack began in June and involved a tampered tool downloaded from the internet. Reuters and Star Advertiser reported that hackers used a bogus job interview and software hidden in an advertisement. ANSA and El Diario mentioned that the attackers had been preparing the violation for months and employed social engineering techniques. Cointelegraph noted that Binance's postmortem revealed how attackers stole credentials and accessed wallet-signing systems.

Right

42 rated outlets

  • Right-rated reports also led with the fake job interview and malicious software as the method of the attack. ARY News and Le Figaro reported that Binance had replenished 98 percent of the affected assets by drawing on its own funds. Fox Business and Startups News | Tech News mentioned the use of a compromised internal AI tool. El Financiero and Yonhap News Agency stated that the campaign was attributed to hackers in North Korea, with Yonhap News Agency specifying that North Korean hackers planted malware on an employee's computer through a fake interview.

Questions about this coverage

How did the left and right cover Binance Hackers Stole $6.3 Billion After Fake Job Interview?
Of the 131 outlets on this story carrying a published leaning rating, 30% are rated left, 35% are rated centre, 35% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 298. The sections above set out what each side emphasised, in its own terms.
Is Binance Hackers Stole $6.3 Billion After Fake Job Interview left or right?
Neither side dominates it. Of the 131 rated outlets on this story, 30% are rated left, 35% are rated centre, 35% are rated right, and no side holds the 70% this site would want before calling a field one-sided. A story is not left or right in any case; the outlets that carried it are what carry ratings.
Is the coverage of Binance Hackers Stole $6.3 Billion After Fake Job Interview biased?
Binance Hackers Stole $6.3 Billion After Fake Job Interview is one event reported by 298 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
Which outlets covered Binance Hackers Stole $6.3 Billion After Fake Job Interview?
298 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
How did hackers steal $6.3 billion from Binance?
Hackers used a multi-stage attack that began in June. They compromised two Binance software engineers' computers by tricking one into downloading tampered software from an advertisement and duping another with a fake job interview. This allowed them to gain access and drain $6.3 billion in cryptocurrency.
Who is blamed for the Binance hack?
The FBI has blamed a North Korean hacking group for the attack. However, North Korea has rejected this claim. The reports do not provide further details on the specific group or evidence presented by the FBI.
What is Binance doing to address the hack?
Binance is repaying all customers whose funds were stolen. The exchange is also increasing its investment in AI-enabled detection systems and working on establishing a security research fund and targeted initiatives with leading AI companies.

Read it at the source

299 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.

Left

41
Show 33 more

Centre

48
Show 40 more

Right

42
Show 34 more

Not rated

168
Show 160 more

How did this read?

About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.

More in Business & Economy

All Business & Economy →
China's 9th Import Expo Opens in Shanghai with Record Exhibitors3 min readChina's 9th Import Expo Opens in Shanghai with Record ExhibitorsRead storyEmirates airline profit drops 66% amid regional conflict and high fuel costs3 min readEmirates airline profit drops 66% amid regional conflict and high fuel costsRead storyShippingcontainere står stablet på et Mærsk-skib, der ligger til kaj ved havnen i Los Angeles i den amerikanske delstat Californien den 10. marts 2026. (Arkivfoto). Caroline Brehman/Reuters2 min readMærsk raises profit forecast for third time in 2026Read story

Elsewhere on the site

Cleveland Meredith arrested for threatening federal judgesPolitics•3 min readCleveland Meredith arrested for threatening federal judgesFreezers are emptied and frozen goods are loaded into shopping carts to be thrown away at ICA Kvantum in Sjöbo, Sweden, Monday, Nov. 2, 2026.Conflict & Security•4 min readEU warns of cyberattacks targeting supermarket refrigeration systemsThomas MassiePolitics•2 min readMassie to drop impeachment if Hegseth resignsNJC suspends three judges for misconduct, bars two from promotionPolitics•3 min readNJC suspends three judges for misconduct, bars two from promotion
Binance hacked for $6.3 billion | MediaBias News