North Korean Hackers Used Fake Job Interviews to Breach Binance Before $6.34 Billion Theft
Binance has disclosed that hackers linked to North Korea allegedly spent months infiltrating internal systems through a social engineering campaign aimed at employees. In September, hackers posing as recruiters contacted a Binance software engineer through a legitimate job platform. The engineer completed a video interview with a fake HR representative, who shared social media profiles containing personal photos and videos to build credibility. A second interview followed with a person posing as the CEO of a fictitious company. Near the end of that interview, the engineer was told to download a coding assignment onto a work computer. The assignment carried sophisticated malware that bypassed the endpoint security protections at Binance and gave the attackers access to the machine. On October 20, the hackers used the compromised computer and an internal Binance AI tool to reach two more engineers working on wallet infrastructure. They found a container deployment token on a computer used by one of those engineers. On October 29, the attackers accessed a computer used by another engineer, used stolen credentials to deploy a malicious container and compromised the Binance wallet signing infrastructure. That access let them authorize fraudulent transactions across multiple blockchains and steal $6.34 billion in digital assets. Binance says $2.85 billion has since been frozen or intercepted, and 98% of impacted token assets have been replenished. The FBI attributes the attack to the North Korea-linked TraderTraitor hacking group.
