How a fake interview and a malicious ad stole $6.3 billion to Binance
On October 29, 2026, Binance suffered the greatest theft of criptomonedas of the story.
But it was not what I thought it was.
On 3 November, Binance Co-CEO Richard Teng revealed technical details that completely change our understanding of the attack. was Not a simple ‘DevOps hacked’. It was an operation of social engineering sophisticated, which began 4 months earlier.
The attack in three acts
Act 1: The fake interview (June 2026)
FACT (according to Fox Business , and CNBC):
The attackers did not start compromising internal systems. They began making fake apps of work to engineers of Binance.
- They set up fake profiles of recruiters
- Invited to 2 engineers Binance to ‘interviews’
- The interviews were false — the goal was to compromise their computers
How? The technical details were not fully revealed, but known patterns suggest:
- Malicious link in the ‘invitation to interview’
- Software hidden in the document ‘description of work’
- Or download the tools techniques of proof’ during the interview
Act 2: Software in an ad (August-September)
FACT: Hackers distributed malicious code through an ad/advertising.
SPECULATION CONTROLLED: we do Not have specific details of where it was distributed by the ad (what LinkedIn? What Are Google Ads? what advertising on sites of tech?), but the fact that it was through advertising suggests:
- Attack ‘supply chain’ via ad platform
- Or infiltration of advertising within the sites where they work employees Binance
- Scale: potentially exposed thousands of people, not just employees of Binance
Act 3: The exfiltration (29-30 October)
FACT: A third computer was used to drain the funds.
This is critical: this means that the access was pre-positioned. attackers:
- Already had credentials of internal systems (the first 2 engineers)
- Already had malware in position
- Just needed to run
In about 20 minutes, $6.3 billion were extracted.
Why this is different
The initial analysis assumed that the laptop is for AN engineer, DevOps was directly involved.
The reality is much more sophisticated:
- Multi-stage: The attack did not happen in 20 minutes. It happened in 4 months (June-October).
- Social engineering advanced: it was Not brute force. It was impersonation, trust, and patience.
- Supply chain: The use of an announcement suggests that the access was not only 2 engineers-specific, but potentially dozens or hundreds.
- Pre-positioning: Before exfiltration end, everything was ready. The attack of 20 minutes was just the execution of a plan of 4 months.
The attack vector is real
According To Fox Business:
- Mock interview → commitment of engineers
- Software announcement → mass distribution of the malware
- Access to systems → lateral movement within infrastructure
- Exfiltration → $6.3 trillion in 20 minutes
Implications for critical infrastructure
This attack demonstrates that the greatest vulnerability is not the technology — it is trust.
The attackers didn’t need to:
- Exploits zero-day
- Unknown vulnerabilities
- Network access direct
Needed:
- Patience (4 months)
- Social engineering (mock interview)
- Distribution of malware (malicious ad)
- A window of opportunity (20 minutes)
How to 24Cevent would have helped
If Binance had a system of detection of anomalies by correlating:
- Access anomalous from new machines and locations → alert
- Anomalous behavior in retirement systems → alert
- Multiple indicators simultaneously → automatic correlation
- Known pattern of attack → escalation critical
The system would have detected in June that something abnormal was happening (access attempts unusual from machines of engineers). Would have alerted the security team: ‘These credentials are being used abnormally from locations unknown’.
Instead of $6.3 billion lost, we would have stopped in recognition phase.
The real cost
Binance said that it has reimbursed the 98% of the funds using its SAFU fund (insurance).
But the real cost is not money — is the erosion of trust.
How long the users of Binance will have confidence that their funds are safe? How many users migrated to other exchanges? How much lost Binance in reputation?
SOURCES CHECKED: