North Korea used LinkedIn, fake job interviews to trick Binance engineer

North Korean hackers stole about $6.3 billion from Binance after a monthslong operation that combined employee deception with malware. They contacted a Binance software engineer through LinkedIn, posing as recruiters for a fictitious company, and arranged staged interviews. The engineer was persuaded to download a malicious “assignment,” giving the attackers access to the employee’s computer. Separately, another engineer clicked an online ad for a tampered version of the Homebrew software package rather than downloading it through normal channels. Binance detected and removed that malware, but the attackers had already learned sensitive details about staff responsibilities and wallet operations. Together, the information and access helped them take over Binance wallets.

The breach relied mainly on familiar phishing and social-engineering methods, not AI to break into the company. After compromising an engineer’s laptop, however, the hackers used Binance’s internal AI tools to reach two more engineers and found a deployment token on one of their computers. Binance says it had previously detected and stopped 57 North Korea-related attempts in 2026. Tether and Circle froze some stolen stablecoins, helping Binance recover roughly $2.5 billion. The exchange paused withdrawals for about 48 hours, then reopened them, saying customer funds were safe and that reserves had replaced 98% of the stolen assets. It is seeking to replenish the remainder, made up of less commonly used currencies.