Binance says North Korean hackers used a fake job interview to infect an employee’s computer with malware, then exploited access to the company’s internal systems to steal about $6.34 billion in digital assets. The exchange detailed the attack in an incident report published today, tracing the breach to a compromise that began in September and culminated in the theft on October 29.
According to Binance, an attacker contacted a software engineer through a legitimate job-hunting platform while posing as a project director at a fictitious company. The recruiter arranged two interviews, including a video call with someone claiming to work in human resources. For the second interview, the employee was asked through a social chat app to download a coding assignment from an online repository.
Binance says the repository contained malicious code that installed custom malware on the engineer’s Mac. The malware replaced a component of a legitimate development tool, allowing attackers to run commands from an external server. The company said endpoint security tools did not detect the malware at the time, and that the attackers concealed activity and removed traces of the compromise.
By October 20, the attackers had used the engineer’s computer and an internal AI tool to compromise two other employees working on Binance’s wallet infrastructure. Binance says they obtained credentials and a container deployment token. On October 29, those credentials were used to deploy a malicious script and gain access to the wallet signing service, enabling transfers across multiple blockchains. The attackers also used Ethereum’s EIP-7702 authorization mechanism to continue stealing assets after Binance suspended withdrawals.
The FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38, according to the report. Binance has not linked the incident to a particular North Korean hacking campaign, but the fake recruiter and malicious coding assignment resemble tactics documented in other campaigns targeting developers and cryptocurrency workers.
Binance says it has rebuilt affected systems, replaced compromised devices and revoked stolen credentials. As of November 3, about $2.85 billion in stolen assets had been frozen or intercepted. The exchange also said that 98% of impacted token assets had been replenished as of October 31, and that it continues to investigate with help from independent security firms.
Sources: BleepingComputer.