Binance Hack Drained $6.3 Billion in 20 Minutes Via Fake Job Interview

Fake Job Interview, Twenty-Minute Drain

On October 29, approximately $6.3 billion left Binance's wallets in about twenty minutes, the largest theft in crypto history and more than four times the size of the Bybit breach of February 2025. According to the exchange's own account, the entry point was an engineer's computer, infected after a fake job interview. From that machine the attacker obtained signing power inside the platform's internal system: Binance's setup was tricked into approving 50 authorizations in a single batch, and one of them was enough to hand over a wallet holding $2.2 billion, a movement recorded publicly at the attacker's Etherscan address. Two days later, on October 31, Binance announced it had restored 98% of the assets with its own funds, and withdrawals resumed the following day; the recovery can be checked against the company's proof of reserves disclosure. The root cause was not a cryptographic break but identity compromise combined with a signing workflow that allowed dozens of approvals in one action. The episode lands in a familiar sequence: Mt. Gox in 2014, QuadrigaCX in 2019, FTX in 2022, Bybit in 2025, and now this. Each time, the reflexive answer is self-custody, on the logic that without the private key you hold a claim rather than the asset. The premise is technically sound; the conclusion usually drawn from it, that self-custody is automatically safer, does not survive contact with the record of individual losses. When an individual loses everything, almost nobody finds out: the trail may sit fully on-chain, but few outsiders follow blockchain investigations, and many victims never file a police report.

Quieter Losses Off the Exchange

The record from 2026 shows what that silence hides. On January 10, an investor read his hardware wallet's seed phrase aloud to a scammer posing as Trezor support; the device worked perfectly, and its owner lost 1,459 BTC and 2.05 million LTC, more than $282 million. The stolen coins began converting to Monero immediately, and freezes occur only when the money touches a stablecoin issuer or an exchange. Signature phishing added $6.3 million in January alone: victims sign off-chain messages granting third parties standing permission to move tokens, effectively a blank check. In one address-poisoning case that month, a victim copied a near-identical wallet address planted in the transaction history and sent $12.25 million to the wrong recipient. Physical coercion bypasses cryptography entirely; CertiK counted 52 wrench attacks in the first half of 2026, worth $124 million in total, 33 of them in France. Devices fail as well: on July 29, ColdCard users who had never connected their units to the internet were drained through a randomness flaw in key generation, losing more than 1,000 bitcoins. Recovery outcomes diverge sharply by custody type. Bybit restored customer backing within three days, and Bitget covered the $388 million taken in September through its protection fund; Mt. Gox creditors waited about a decade for roughly 15% of their bitcoins, while FTX creditors received about 120% in cash from a collapse that came with bitcoin near $16,000. Brazil's Central Bank Resolutions 519, 520 and 521 of 2025 now push the counterparty model toward verifiability, requiring segregated customer assets in separate wallets, proof of reserves, independent audits and a ban on using client funds in the company's own operations.

Reading the Custody Math

Read together, the two records argue that custody is an allocation of trust rather than a binary choice. The Binance post-mortem and the on-chain trail show an operational failure, a phished employee and a batch-signing policy, not a defect in exchange custody itself, and the company covered 100% of the loss while restoring 98%, an outcome none of the January victims enjoyed because self-custody offers no counterparty at all. Anyone weighing crypto exchange versus wallet custody should size both options against their own operational competence: a split across strong venues, disciplined self-custody and listed funds keeps any single failure from becoming fatal. That allocation is the one responsibility that cannot be delegated.