Binance reveals North Korean hackers used fake job interview to steal $6.3 billion
The exchange says the TraderTraitor unit spent months building trust with an engineer before launching the largest crypto heist in history.
By Ariana Flores ·
Binance suffered a $6.3 billion cyber heist last week after a North Korean hacking unit used a fake job interview to compromise one of its employees. The exchange released an initial assessment on Tuesday detailing how the attack unfolded over several months. The FBI has identified the attackers as TraderTraitor, a state-sponsored military unit from North Korea.
The breach began in June when the hackers first probed Binance's security systems. The exchange detected and stopped that initial attempt, but the intrusion gave the attackers valuable intelligence about the platform. They returned in September with a more sophisticated social engineering campaign. A person posing as a project director from a fictitious company contacted a Binance engineer through a job-hunting platform.
The engineer agreed to a first-round interview with a supposed HR representative. The hackers used this interaction to build rapport, sharing fake social media accounts, personal photos, and videos with the employee. Binance described the tactic as more advanced and deceptive than typical social engineering approaches. The engineer was then invited to a second interview with the alleged CEO on a popular social chat app.
During this second interview, the engineer was working on his company laptop. The interviewer asked him to download a file labeled as an assignment for the recruitment process. The file contained malicious code that allowed the hackers to establish a foothold in Binance's network. This access culminated in last week's massive theft of over $6 billion in customer cryptocurrencies.
Binance stated that it has already replaced most of the stolen funds using its own reserves. The company is conducting an independent cybersecurity review to prevent similar future incidents. The exchange acknowledged the failure in its public statement, noting that the event should not have occurred. It apologized to users, partners, and the wider industry for the disruption and uncertainty caused by the attack.
