North Korean hackers used fake job interview to infiltrate Binance, enabling $6.3 billion theft
Binance disclosed that a multi-stage attack involving a counterfeit job interview and malware led to the October 29 breach that facilitated a $6.3 billion cryptocurrency theft attributed to a North Korean hacking group.
Binance said a sophisticated, multi-stage campaign compromised its wallet infrastructure, culminating in a $6.3 billion cryptocurrency theft on Oct. 29. The breach began with a supply-chain attack in June when an engineer installed a malicious Homebrew package, prompting the security team to replace the device and rotate credentials.
In September, a software engineer was approached on a job-search platform by an individual posing as a project director. The impostor arranged a series of interviews with a fabricated company, including a video call with a fake HR representative who shared personal social-media content to build trust. A subsequent interview with a person claiming to be the company’s CEO, conducted on a popular messaging app, concluded with the engineer being instructed to download an “assignment” that contained a malware-laden code repository.
The malware replaced a legitimate development-tool component, establishing communication with an external server and evading Binance’s endpoint security tools. Using the compromised machine and an internal AI tool, the attackers accessed additional engineers’ computers, obtained a container-deployment token, and on Oct. 29 deployed a container that triggered the cryptocurrency-stealing script.
Binance has rebuilt the affected wallet system, replaced compromised devices, and decommissioned all related credentials and tokens. The exchange is cooperating with law-enforcement agencies, blockchain-intelligence firms, and security researchers, and has engaged independent cybersecurity experts to review its defenses. It also announced plans to fund security research focused on AI safety in blockchain environments.
“Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident,” the incident report stated.
The FBI has linked the theft to TraderTraitor, a North Korean hacking operation associated with the Lazarus Group, which is known for combining espionage with large-scale cryptocurrency heists.