North Korean fake job interview led to $6.3B Binance heist

North Korean hacking group TraderTraitor, linked to the Lazarus Group, carried out a multistage attack that led to a reported $6.3 billion cryptocurrency theft from Binance on October 29. The exchange says the operation combined a supply-chain compromise, carefully staged social engineering, malware, access to internal systems and a method for authorizing fraudulent transactions. It was not a single phishing email or isolated breach. The attackers began preparing in June, when an engineer installed a malicious Homebrew package. Binance detected the malware, replaced the device and rotated credentials, but says the engineer’s role and colleagues in the wallet infrastructure team were exposed.

In September, attackers contacted another Binance engineer through a legitimate job-search platform, posing as staff at a company offering interviews. They built trust with personal social-media material, then used a fake CEO interview to persuade the engineer to download a malware-infected coding assignment. The malware replaced a legitimate development-tool component, hid its activity and evaded endpoint security. In October, attackers used the compromised computer and an internal AI tool to reach wallet developers’ machines, then used a stolen deployment token to launch the theft. Binance says it rebuilt affected systems, replaced devices and revoked credentials and tokens. It is working with law enforcement and blockchain specialists to trace and freeze assets, while commissioning an independent security review.