Binance’s fake job interview breach, North Korea’s denial, a Moldova data theft and fake alerts in Ukraine and Russia
TF’s 3–4 November 2026 cybercrime round-up covers Binance’s breach trail, North Korea’s denial, Moldova and fake alerts. Binance leads again as the exchange explains how the hackers got in. A state actor is suspected in Moldova, while Ukraine and Russia both report fake warnings.
What’s Happening & Why It Matters
Binance Traces $6.3 Billion Hack to a Fake Job Interview
Binance (@binance) says attackers spent weeks posing as recruiters to compromise an engineer. A supposed HR contact ran the first interview. A fake company chief then sent a file disguised as an interview assignment, which was malware. Binance calls the malware zero-day, missed by its endpoint protection.
Binance’s account starts in June, when a developer installed a tampered tool and security staff replaced the device. By 20 October the attackers had breached two more employees’ computers. On 29 October they logged into a third employee’s machine and started the transfers. Binance says the hot wallet used multi-party computation, so no single key could cancel the attackers’ approvals. Transfers ran for almost two hours.
Attackers used an internal AI tool, and Binance has not explained how. The exchange puts the loss at $6.3 billion (about €5.6 billion). Binance says about $2.85 billion (about €2.5 billion) was frozen or intercepted. Replacement covers 98% of affected tokens, up from 90% on 1 November. Binance blames North Korea, in line with the FBI. TF covered the earlier details in its Binance story.
North Korea Denies the Binance Hack and Fires Missiles
Kim Yo-jong, sister of leader Kim Jong-un, called the FBI claims a “grave political provocation”. She dismissed them as nothing new and pointed to the 2025 Bybit accusations. On 2 November, state media said North Korea test-fired strategic cruise missiles with a new cluster warhead.
An expert quoted by AFP said the haul equals almost a quarter of North Korea’s estimated annual GDP. The expert suggested the denial keeps laundering channels open. UN sanctions bar ballistic missile launches, but cruise missile tests fall outside them. South Korea’s president called for stronger cyber defences.
Moldova Suspects a State Actor of Data Theft
Prime Minister Vasile Tofan told Euronews on 3 November 2026 a state actor is suspected in cyberattacks on government databases. Hackers reached citizens’ personal identification numbers. Tofan cited about 750,000 data sets, a figure he did not clarify.
He named no suspect but said the list of suspects is short. Authorities had early warnings, and Tofan cancelled a Brussels trip to handle the attacks. Moldova reported alleged Russian interference in its election campaign last year.
Fake Alerts Strike Ukraine and Russia
On the evening of 1 November, Ukraine’s Air Force said hackers broke into its air raid alert app. Users saw false warnings about nuclear and chemical threats near Kyiv. One message claimed Russia had fired an Oreshnik missile. The Air Force said there was no radiation threat.
On 2 November, Russia’s Emergencies Ministry reported a massive cyberattack on its warning app, which spread false information. The ministry named no culprit, while Ukraine’s Centre for Strategic Communications blamed Russia. The hacks followed the end of a local ceasefire in Russian-occupied Kherson. Euronews adds seven countries reported supermarket refrigeration attacks, covered in TF’s fridge story.
My take: Binance shows social engineering beats strong wallets, because one fake interview opened months of access. Moldova, Ukraine and Russia show attackers targeting public trust. Alert apps and citizen databases are the systems governments depend on in a crisis.
TF Summary: What’s Next
Binance will publish a full post-mortem, and security teams will study its fake recruiter lessons. Moldova will name or drop its state-actor theory. Ukraine and Russia will secure alert apps while the Kherson truce stays broken.
MY FORECAST: Engineers at other exchanges will report fake recruiter approaches within a month. Moldova will blame Russia in public by year end. Alert apps will face more attacks over winter.
Related Stories
- Binance Replaces 90% of $6.3Bn Hack Losses as FBI Blames North Korea
- Hackers Warm Supermarket Fridges Across Europe in Second Wave
- TF Cybercrime Round-up: 30 October 2026
- TF Cybercrime Round-up: 6–11 October 2026
- Data Centres Turn Into War Targets in Ukraine, Russia and Iran