What Is a Social Engineering Attack? Lessons From the $6.3bn Binance Hack
On 29 October 2026, attackers took around $6.3 billion in cryptocurrency from Binance, the world’s largest crypto exchange. According to Binance’s own incident report, one of the ways in was a fake job interview with an engineer who was looking for his next role. No patch or firewall rule would have stopped that conversation, and that is why social engineering remains the most dependable way into an organisation.
ISO 27001 treats information security as a combination of people, processes and technology. Most security budgets go on the technology. Attackers know this, so many of their campaigns start with a convincing message or a held-open door. This article explains what a social engineering attack is, how one led to the Binance hack, and what UK organisations can do to protect their people.
What Is a Social Engineering Attack?
A social engineering attack is a cyber attack that targets people instead of technology. The attacker uses deception, such as a fake email, phone call, recruiter or visitor, to persuade someone to hand over credentials, run malicious software, approve a payment or let a stranger into a building. It exploits trust, urgency, helpfulness and ambition. Because it needs no software vulnerability, it works against well-patched organisations too. Common techniques include…
- Phishing: emails, texts or chat messages that push people to click a link, open an attachment or enter their credentials.
- Vishing: phone calls from someone posing as IT support, a supplier or a senior colleague.
- Pretexting: a believable cover story built up over days or weeks, such as a recruiter, auditor or new supplier.
- Baiting: an offer that is hard to ignore, from a free software download to a well-paid job.
- Tailgating: following someone with legitimate access through a secure door.
- Deepfake impersonation: AI-generated voice or video of a person the target trusts.
How Common Are Social Engineering Attacks in 2026?
People are involved in most breaches. Verizon’s 2026 Data Breach Investigations Report found the human element in 62% of breaches, up from 60% the year before. Social engineering was the third most common breach pattern at 16% of breaches, and 41% of those social engineering breaches used a channel other than email.
The UK picture is just as clear. The government’s Cyber Security Breaches Survey 2025/2026, published in April 2026, found that:
- 43% of UK businesses, around 612,000 organisations, identified a cyber breach or attack in the previous 12 months.
- Phishing affected 38% of businesses and was named the most disruptive attack by 69% of those breached.
- Among breached businesses, the share hit by phishing alone rose from 45% to 51%. Interviewees told researchers they felt phishing had become easier for attackers to carry out.
- Only 19% of businesses ran any staff training or awareness activity in the year, and 22% had tested staff with mock phishing exercises.
Attack volumes are holding steady while training levels stay flat, which leaves people exposed to techniques that keep improving.
How Did a Social Engineering Attack Lead to the $6.3bn Binance Hack?
Binance’s incident report, published on November 3rd 2026, describes a campaign that ran for five months before any money moved.
June 2026
An engineer on Binance’s wallet team wanted to install an AI coding tool. He found what looked like the Homebrew installer through a search engine and downloaded a tampered version. Binance’s security team spotted the infection, replaced his laptop and reset his credentials. By then the attackers had already learned what he worked on and who his colleagues were.
September 2026
A second engineer, who was looking for a new job, was approached on a legitimate recruitment platform by someone posing as a project director at a company that did not exist. He went through several interview rounds, including a video call with someone presenting as the company’s chief executive. He was then asked to download a coding test, which he ran on his work computer. The malware replaced a legitimate developer tool component, opened a connection to the attackers’ server and, according to Binance, went undetected by its security software.
20 October 2026
The attackers used that compromised machine, together with an internal AI tool, to take control of the systems used by two wallet developers and obtain credentials to deploy software into the wallet infrastructure.
29 October 2026
Using those credentials, they ran a malicious script against Binance’s wallet-signing service. Within four minutes they had drained 233.46 million XRP from five hot wallets, then moved on to bitcoin and other assets.
The FBI has attributed the theft to North Korea’s TraderTraitor group, which North Korea denies. Binance says around $2.85 billion has been frozen or intercepted and that it will cover all customer losses. Its investigation is ongoing.
How the Fake Job Interview Scam Works
Binance was not an isolated target. In September 2026, security agencies in the U.S., Japan, Australia and Germany warned that a North Korean group known as WaterPlum had used fake job postings and malicious coding tests to infect more than 30,000 devices in over 100 countries, compromising more than 7,000 cryptocurrency wallets. Our partner Sophos has also tracked a North Korea-linked group it calls Nickel Alley approaching freelance developers on LinkedIn, Upwork and Fiverr.
The approach works because recruitment sits outside most security controls. The conversation happens on a job platform and a video call, where email filtering cannot see it. The candidate wants to impress, and downloading and running code from a stranger is a normal part of a technical interview.
Would Your Team Spot a Fake Recruiter?
Our CREST-accredited testers run realistic phishing, vishing and pretexting campaigns against your people, then show you where the process broke.
What Can UK Organisations Learn From the Binance Attack?
Most UK organisations are not crypto exchanges, but the methods used against Binance work on any business with people who have access to something valuable.
Your attack surface includes your people’s careers
The decisive approach came through a legitimate recruitment platform. Developers, finance staff and anyone with privileged access are worth targeting, and job hunting gives attackers a reason to start a conversation that your email gateway will never see.
Work devices should never run code from an interview
The coding test ran on a work laptop with access to internal systems. Set a clear policy that work devices are not used for external interviews or for running code from unknown sources, and back it up with application control so unapproved software cannot run.
A contained attempt still gives attackers intelligence
Binance caught the June infection, yet the attackers still walked away knowing who to target next. After any incident, ask what the attacker may have learned about your people and structure as well as whether the malware is gone.
AI tools are now part of the attack path
AI appeared twice in this attack: a fake installer downloaded while setting up an AI coding tool, and an internal AI tool used to reach other engineers’ systems. The Cyber Security Breaches Survey found that 31% of UK businesses are using, adopting or considering AI, but only 24% of those have cyber security practices to manage the risks. An internal AI assistant with broad access is a privileged system and should be tested like one.
High-value actions need more than one point of failure
A handful of compromised engineers was enough to reach wallet signing. Separate duties for high-value actions, watch privileged identities for unusual behaviour and make sure someone is monitoring around the clock.
“The Binance attack follows the same pattern we use on our red team engagements, with more patience and a much bigger budget. Find the people with access, learn what they care about and give them a reason to trust you. On our engagements the first thing to give way is usually someone’s judgement that a request looks normal, and that is something you can test and train.”
– Wayne Price, Commercial Director, CyberLab
How Is AI Changing Social Engineering?
AI has removed many of the signs people were trained to look for. Spelling mistakes and awkward phrasing have largely gone, and attackers can personalise messages for thousands of targets at once, adjusting in real time to how each person responds.
Voice and video impersonation is now practical too. In 2024, criminals used deepfake video of a multinational company’s Chief Financial Officer and other staff to persuade an employee in Hong Kong to transfer the equivalent of almost £20 million, as reported by Ars Technica. The Binance case shows a related shift: attackers are prepared to sustain a fake company, a fake recruiter and a fake chief executive through several rounds of interviews to reach one person.
As AI tools spread inside organisations, they also become targets. An assistant that can read code, files or messages across a business is exactly what an attacker wants access to once they are in.
How Can You Protect Your Organisation Against Social Engineering?
No single control stops social engineering. The organisations that hold up best combine clear policies, strong authentication, realistic training, regular testing and fast detection.
Policies that cover the new routes in
- Require any request for payment, credentials or access changes to be verified through a separate, known channel.
- Ban the use of work devices for external interviews and for running code or software from unapproved sources, including AI tools.
- Apply least privilege, so one compromised account cannot reach your most valuable systems.
Multi-factor authentication everywhere
Only 47% of UK businesses use two-factor authentication, according to the Cyber Security Breaches Survey. Turn on multi-factor authentication (MFA) for every cloud service and remote access route, and use phishing-resistant methods such as passkeys or hardware security keys for privileged accounts. MFA on cloud services is also now a firm requirement for Cyber Essentials certification.
Training that reflects how attacks happen now
- Tailor training by role. Developers, finance teams, executives and recruiters each face different lures.
- Cover channels beyond email, including job platforms, messaging apps, phone calls and video calls.
- Make reporting easy and blame-free, so a suspicious approach is raised in minutes rather than hidden.
The NCSC’s 10 Steps to Cyber Security guidance on engagement and training is a good starting framework.
Regular security testing
- Social Engineering Testing measures how your people respond to phishing, vishing, pretexting and physical intrusion attempts.
- Red Teaming simulates a determined attacker across people, process and technology, much like the Binance campaign.
- Penetration Testing finds the technical weaknesses an attacker would use once inside.
- AI Security Testing checks whether your AI tools can be manipulated or misused.
Detection and incident response
Binance’s attackers needed only four minutes once they reached the wallet-signing service. Round-the-clock monitoring through Sophos MDR gives you the best chance of catching unusual activity earlier in the chain. Only 25% of UK businesses have a formal incident response plan, so write one, then rehearse it with a tabletop exercise built around a social engineering scenario. If the worst happens, our Incident Response team is ready to help.
For further guidance, see the NCSC’s advice on defending against phishing.
How CyberLab Supports Your Defence Against Social Engineering
- Our CREST- and CHECK-accredited testers run social engineering, red team and penetration testing engagements based on real attacker behaviour.
- We are one of the first four organisations in the world accredited for CREST Security Testing of AI, so we can test the AI tools your staff rely on.
- We provide 24/7 detection and response through Sophos MDR and Sophos ITDR.
- Our tabletop exercises help leadership teams rehearse their response to a social engineering incident.
- More than 1,200 UK organisations, including over 60 NHS Trusts, trust us to protect their people and systems.