On October 29, 2026, Binance, the world’s largest crypto exchange, suffered the biggest crypto theft on record: about $6.3 billion. What stood out wasn’t the amount, but how it started. There was no bug in the code and no weak password. It started with a job interview.
It’s a textbook case of social engineering: tricking a person into opening the door from the inside. At HitOcean we interview developers every week and place engineers on our clients’ teams, so this one hits close to home. Here’s what social engineering attacks look like, how the Binance hack unfolded and what we took away from it.
What is social engineering?
Social engineering is the set of techniques attackers use to manipulate a person into giving them something they wouldn’t hand over otherwise: a password, access, a wire transfer or running a file.
The logic is simple. Breaking into a well-protected system is slow and expensive. Convincing someone who already has access is usually much easier. That’s why most serious incidents have, at some point, a person who trusted the wrong party.
Social engineering attacks lean on very human emotions:
- Urgency: “I need this before 6 p.m.”
- Authority: the message seems to come from the CEO, a bank or a vendor.
- Opportunity: a better-paying job, a prize, an investment.
- Trust: someone you met weeks ago who seems real.
Types of social engineering attacks
| Type | How it works | Example |
|---|---|---|
| Phishing | Fake emails or messages that imitate someone trusted | A “bank alert” asking you to confirm your details |
| Spear phishing | Phishing tailored to one specific person | An email that mentions your project and your manager by name |
| Vishing | Deception by phone or voice message | ”Tech support” asking for a verification code |
| Pretexting | A made-up story that justifies the request | A job offer with interviews and a coding assignment |
| Baiting | Bait the victim opens on their own | A “free” tool or a code repository |
| Business email compromise (BEC) | The attacker poses as a decision-maker | A “CEO” asking for an urgent wire transfer |
How the Binance hack happened, step by step
Binance published a preliminary report on November 3. According to that report and coverage from outlets like NBC News and Security Affairs, this wasn’t a one-day job. It took months:
- June: a tampered tool. An engineer on the team that runs Binance’s wallets searched online for an AI coding tool and downloaded a modified version. Binance caught it, replaced the laptop and rotated the credentials. But the attackers already knew who he was, what he did and who his teammates were.
- September: the fake interview. Another engineer, who was looking for a job, got an offer. He had two interviews: one with a supposed HR person, whose social media was full of photos to look real, and another with the “CEO” of a company that didn’t exist. At the end, he was asked to complete a coding assignment. He downloaded it onto his work computer. The assignment carried malicious code, and Binance’s security tools didn’t catch it.
- October 20: moving inside. From that computer, the attackers used an internal Binance AI tool to reach the machines of two other engineers, including the one from June. On one of them they found a token with permission to deploy software to the infrastructure.
- October 29: the heist. With those credentials they reached the service that signs wallet transactions and started moving funds outside the normal withdrawal flow. Pausing withdrawals wasn’t enough to stop it, because the authorizations were already in place. Binance cut off the last one just after midnight.
Binance says it will cover its users’ losses and has already replenished 98% of the affected assets. The FBI attributed the attack to TraderTraitor, a North Korea-linked group, which denies involvement.
What this case teaches us
1. The way in was a person, not a system
Binance has one of the largest security teams in the industry. Even so, the attacker didn’t need to breach its systems from the outside: it was enough for one engineer to trust a hiring process that looked normal. No amount of security tooling replaces a team that can recognize a con.
2. Job interviews are a new attack surface
This one matters to us in particular. Fake job offers have become a standard method for sophisticated attack groups, because they play on something legitimate: the desire to grow professionally. And the “take-home coding assignment” is the perfect excuse to get a developer to run someone else’s code.
The flip side exists too: fake candidates trying to get hired to gain access from the inside. Binance said it detected and stopped 57 suspected North Korea-linked cases in 2026. That’s why, when a company brings in outside developers, verifying who each person is and what access they get is part of security, not paperwork. It’s one of the things we take care of in our nearshore software development services.
3. The first warning wasn’t fully closed
In June, Binance detected the problem and fixed it on the affected laptop. But the information that had already leaked (roles, names, teams) helped the attacker set up the second stage. Closing an incident isn’t just cleaning a device: you also have to ask what the attacker now knows and what they can do with it.
4. AI tools are a door too
The attackers used AI twice: a tampered coding tool and an internal tool built by the company itself. The report doesn’t point to a flaw in the AI model, but to how much access the tool had. If an AI assistant can reach other employees’ machines, so can whoever controls it. If you’re bringing AI agents into your team’s workflow, our guide to the best AI coding agents covers how to adopt them without losing control.
5. One permission can be enough
The final jump was a token, a kind of digital key, with permission to deploy software, stored on an engineer’s computer. The fewer critical permissions each person and each machine holds, the less damage anyone who steals them can do.
How to protect your company from social engineering
You don’t have to be an exchange to be a target. These measures work for any company:
- Train with real cases. A generic phishing talk doesn’t prepare anyone for a fake two-round interview with a “CEO”. Show them cases like Binance.
- Keep personal and work separate. No technical tests, third-party tools or job-search files on a work computer.
- Control what gets installed. Development and AI tools come only from verified sources, and someone reviews what goes in.
- Give each person only the access they need. And review it often, especially access that can move money or deploy software.
- Require more than one approval for critical actions. A large transfer or a production change shouldn’t depend on one person or one computer.
- Verify who you bring in. Confirm the identity of everyone who joins your team, employee or contractor, before giving them access.
- Test yourself. Penetration testing or a cybersecurity audit shows where someone could get in before an attacker finds out. Tests can include social engineering simulations.
The bottom line
The Binance hack shows that social engineering is no longer a badly written email asking for a password. It’s a patient, months-long operation that studies people, builds believable stories and exploits every access it finds.
The good news is that it can be prevented with method: alert people, clear processes and well-guarded access. If you want to know how exposed your company is, our security services for companies can help you find out.