Binance says North Korean hackers used fake job interviews in $6.3 billion theft

A North Korean hacking group carried out the biggest crypto theft on record, worth $6.3 billion, by layering familiar intrusion methods across several months, according to a Binance postmortem reported by The Verge. The FBI has linked the operation to a unit it calls TraderTraitor, the company says.

Binance traces the start to June, when one of its developers ran a tampered installer that appears to have arrived through a poisoned Google search ad. That step exposed information about the engineers and their working habits, the company says.

A second engineer became a target in September. Someone posing as a recruiter arranged several calls and repeated interview rounds, pointed to social media profiles to appear credible, and finally asked the worker to download a take-home task that was in fact malware.

Binance says its security staff did spot the June malware and swapped out that employee's machine. The later intrusion slipped past its defenses, the postmortem states. The attackers deleted the pyenv executable and put a malicious copy in its place, which gave them backdoor access. Binance describes the code as 0-day malware that endpoint protection tools missed at the time, and says the intruders worked to hide their activity and erase evidence.

By October 20, according to the company, the attackers abused Binance's own internal AI tool to seize control of wallets belonging to the first engineer and a third employee. They signed into the third worker's computer on October 29 and began the theft.

Binance also explains why it could not halt transfers that followed the first unauthorized movements by close to two hours. The hot wallet relied on Multi-Party Computation, so no single private key existed to revoke the malicious EIP-7702 authorizations right away.

CEO Richard Teng says customers are not absorbing the loss. About $2.85 billion in stolen assets has been frozen or intercepted, roughly 98% of affected tokens have been replaced, and withdrawals have largely resumed, he writes. Binance says it has blocked 57 suspected cases tied to North Korea.

Questions remain about why the scheme succeeded, given years of warnings about interview tasks that ask candidates to run code on work machines, and about how the internal AI tool was exploited.