North Korean Hackers Stole $6.3 Billion From Binance via Fake Job Interview

Six and a half billion dollars vanished from Binance last week, marking the largest cryptocurrency theft ever recorded. The exchange announced on Tuesday that the attackers likely executed the final drain in roughly 20 minutes, but the setup took months. The FBI has identified the group behind the breach as TraderTraitor, a North Korean state-sponsored military unit.

The intrusion began in June when hackers probed Binance security systems. The exchange detected and stopped that initial attempt, but the activity provided the attackers with a map of the company's defenses. By September, the strategy shifted from technical scanning to human manipulation.

A Binance engineer received a contact on a job hunting platform from a person claiming to be a project director at a new firm. The engineer completed a first interview with a supposed HR representative. The interviewer shared personal social media accounts, photos, and videos to build rapport. Binance described this approach as more advanced and deceptive than social engineering tactics seen before.

The operation culminated in a second interview scheduled on a popular chat application. The interviewer posed as the chief executive of the fictitious company. While the engineer worked from his laptop, the interviewer asked him to download a file described as a recruitment assignment. The file contained malicious code that gave the hackers a foothold in the system.

Using that access, the attackers built an attack over several weeks. Last week, they moved more than $6 billion in cryptocurrency belonging to customers. Binance stated that it has already replaced most of the stolen assets using its own funds. The company also launched an independent cybersecurity review to prevent similar incidents.

In a statement posted on X, Binance apologized for the disruption and uncertainty caused to users and partners. The exchange noted that the incident should not have happened. The assessment details how a simple job inquiry evolved into a global financial shock.