Binance reports $6.3 billion theft by North Korean hackers using social-engineering ploy
Binance disclosed that a North Korean state-sponsored group infiltrated the exchange through a fake job interview, resulting in the theft of about $6.3 billion in customer crypto assets.
Binance said a North Korean military unit identified by the FBI as "TraderTraitor" carried out the theft after months of reconnaissance. The attackers first probed the exchange’s defenses in June, but were blocked. In September, a Binance engineer was approached on a job-search platform by someone posing as a project director of a fictitious company. The engineer completed an initial interview, during which the impostors shared fabricated social-media profiles and personal media to gain trust.
"This was more advanced and deceptive than previously seen social engineering approaches," Binance said.
The engineer later received a second interview invitation with a supposed CEO via a popular chat app. During that call, he was asked to download an "assignment" on his work laptop, which actually contained malicious code. The code enabled the hackers to execute a rapid attack that transferred more than $6 billion worth of cryptocurrencies held by Binance customers.
Binance announced that it has reimbursed most of the stolen assets using its own funds and is commissioning an independent cybersecurity review to strengthen its defenses.
"This should not have happened," the exchange said, adding that it apologizes for the concern, disruption and uncertainty caused to users, partners and the broader industry.