Binance Breach: Fake Job Interview Led to $6.3B Heist
FBI identifies North Korean unit behind attack that began with social engineering and ended with a massive crypto theft.
By Jabari Long ·
The largest cryptocurrency heist in history unfolded over a period of months, culminating in a breach of Binance that lasted approximately twenty minutes. An initial assessment released by the exchange on Tuesday details how a North Korean state-sponsored unit executed the theft.
Hackers identified by the FBI as the TraderTraitor military unit first probed Binance’s security infrastructure in June. The exchange detected and blocked that initial intrusion. However, the failed attempt provided the attackers with data on Binance’s internal systems. They returned in September with a different strategy.
The group contacted a Binance engineer through a job hunting platform. The recruiter posed as a project director for a fictitious company. The engineer completed a first round interview with a supposed human resources representative. The fake interviewer built trust by sharing personal photos, videos, and social media accounts with the employee.
Binance described the tactic as more advanced and deceptive than previously seen social engineering approaches. The process moved to a second interview with the alleged CEO via a popular chat application. The engineer, working from his laptop, was asked to download an assignment file as part of the recruitment process.
The file contained malicious code. This allowed the hackers to construct an attack that led to the theft of over $6 billion in customer-held cryptocurrencies last week. The funds were withdrawn from Binance’s custody during the final stage of the operation.
The exchange stated it has replaced most of the stolen crypto using its own funds. It is conducting an independent cybersecurity review to prevent similar incidents. Binance acknowledged the failure in its assessment, noting that the event should not have happened. The company apologized for the disruption caused to users, partners, and the industry.
The assessment confirms the attackers leveraged the initial June probe to refine their approach. The September social engineering campaign successfully bypassed standard security protocols. The stolen assets were moved quickly after the malicious code executed.
