--- title: "Binance says $6.34 billion hack began with fake job interview" description: "Binance's incident report says the $6.34 billion theft on Oct. 29 was a five-month campaign that began with a fake job interview and a poisoned developer…" language: en canonical: "https://whycoinmoves.com/en/events/bitcoin-binance-says-6-34-billion-2283261ec35d4d" published: 2026-11-03T16:46:59.000Z updated: 2026-11-03T17:48:00.000Z indexable: true --- # Binance says $6.34 billion hack began with fake job interview Binance's incident report says the $6.34 billion theft on Oct. 29 was a five-month campaign that began with a fake job interview and a poisoned developer… Attributed sources: [Bitcoin Magazine]() ## Key facts Binance's incident report says the $6.34 billion theft on Oct. 29 was a five-month campaign that began with a fake job interview and a poisoned developer tool, Bitcoin Magazine reported. Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds. The FBI has attributed the attack to North Korea, a finding Binance's report cites. Evidence strength: Single source, 1 publisher group(s) (Bitcoin Magazine). After site detection, observed returns were 5 minutes: +0.06% (Nov 3, 2026, 16:46 → Nov 3, 2026, 16:51, UTC; Gate · USDT); 1 hour: +0.26% (Nov 3, 2026, 16:46 → Nov 3, 2026, 17:46, UTC; Gate · USDT) In the preceding 30 days, the 99th percentile of absolute hourly returns was 1.23% (OKX · USDT; cutoff Nov 3, 2026, 16:46, UTC). ## Returns after site detection | Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source | | --- | --- | --- | --- | --- | --- | | 5 minutes | +0.06% | +0.06% | 0.00 pts | Nov 3, 2026, 16:46 → Nov 3, 2026, 16:51 | Gate · USDT | | 1 hour | +0.26% | +0.26% | 0.00 pts | Nov 3, 2026, 16:46 → Nov 3, 2026, 17:46 | Gate · USDT | ## Historical hourly baseline | Metric | Value | | --- | --- | | Coverage | 100.0% (720/720) | | Median absolute hourly return | 0.15% | | 99th percentile of absolute hourly returns | 1.23% | | BTC beta | 1.00 | | Source / cutoff (UTC) | OKX · USDT / Nov 3, 2026, 16:46 | ## Claims and open questions - Binance's incident report says the $6.34 billion theft on Oct. 29 was a five-month campaign that began with a fake job interview and a poisoned developer tool, per Bitcoin Magazine. - Binance said it has frozen or intercepted about $2.85 billion of the stolen assets and replenished 98% of affected tokens from its own funds, with the balance bought on the open market. - Binance said the attackers used a machine and an internal AI tool to reach two more wallet engineers on Oct. 20, then deployed a container with stolen credentials and launched the drain on Oct. 29 between 17:15 and 19:56 UTC. - Will Binance publish the full incident report and any further breakdown of how the frozen or intercepted $2.85 billion was recovered? - What is the status of the remaining stolen assets not frozen or replenished, and what would on-chain data or an exchange notice show? ## Source evidence - [Binance Says $6.34 Billion Hack Began With Fake Job Interview]() — Bitcoin Magazine; published Nov 3, 2026, 16:44; received Nov 3, 2026, 16:46 (UTC). ## Recent BTC events and market reactions - [TD Cowen analyst says Democratic Congress would block CLARITY Act for two years]() — Published Nov 3, 2026, 17:39 (UTC) · Single source (1 publisher) · Regulation · 5m -0.02% - [CoinDesk says bitcoin is breaking a midterm election pattern dating to 2014]() — Published Nov 3, 2026, 12:30 (UTC) · Single source (1 publisher) · General news · 5m +0.16% / 1h +0.56% - [Liquid Network says bitcoin reserves fully backed again after $320 million exploit]() — Published Nov 3, 2026, 11:12 (UTC) · Multiple publishers (3 publishers) · Security · 5m -0.04% / 1h -0.13% - [Tether CEO says company holds about 150,000 bitcoin worth $11.5 billion]() — Published Nov 3, 2026, 10:15 (UTC) · Multiple publishers (2 publishers) · General news · 5m -0.05% / 1h +0.26% - [Mercado Bitcoin pledges to cover all user losses after near $40 million hack]() — Published Nov 3, 2026, 08:56 (UTC) · Single source (1 publisher) · Security · 5m +0.02% / 1h +0.52% - [Full coin archive]() ## Research for this archive - [Crypto hacks and price impact: Bybit and Cetus case studies]() - [Why is crypto moving? How to check the evidence]() - [Altcoin beta to Bitcoin: BTC, ETH, SOL and DOGE hourly returns]() - [Will Bitcoin go back up? Every crash since 2011 and its recovery time]() Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished. [Methods and limitations]()