North Korea Steals $6.3B from Binance via Fake Interviews
Binance reports massive crypto heist attributed to North Korean hackers using fake interviews and malware.
2 min read
North Korean state-backed hackers executed one of the largest cyber heists in history, siphoning $6.3 billion from Binance through a months-long scheme involving fake job interviews, tampered software, and stolen credentials. The attack, attributed to the cybercrime group TraderTraitor, highlights the growing threat of state-sponsored cyber operations against cryptocurrency platforms.
Attack Unfolds in Stages
The breach began in June 2026 when a Binance employee, referred to as ‘Engineer A,’ inadvertently downloaded tampered software disguised as a popular AI coding tool. Although Binance’s security team detected the malware and replaced Engineer A’s device, the attackers had already gathered critical information about the employee and his colleagues.
In September, the hackers resumed their operation by targeting a second employee, ‘Engineer B,’ through a legitimate job-search platform. Posing as a project director, the attacker convinced Engineer B to pass a fake interview with a HR representative using stolen social media content. In a subsequent round, the attacker, posing as a fake company CEO, tricked Engineer B into downloading a malicious file onto his work computer.
Exploitation and Massive Loss
On October 20, the hackers used the compromised computer, along with an internal Binance AI tool, to gain control of Engineer A and a third employee, ‘Engineer C.’ They discovered Engineer A still had a deployment permission token on his machine, which they used to launch the attack on October 29. Within 20 minutes, the hackers drained billions of dollars from crypto wallets and scattered the funds across global networks.
Binance detected the breach on October 30 and swiftly froze approximately $2.8 billion of the stolen funds. About $3 billion was lost permanently. The company paused withdrawals and promised to cover all customer losses. As of Saturday, Binance had replenished 98% of affected tokens, with the remaining funds being harder to source due to market liquidity issues.
Recovery and Security Measures
To cover the losses, Binance set aside more than $6 billion in company funds, including half of its Secure Asset Fund for Users and money from its corporate treasury. The company plans to rebuild the fund to roughly $1 billion. Despite the breach, Binance’s balance sheet still shows $157 billion in current assets. The company also reported $4.7 billion in customer withdrawals after the hack, alongside broader market swings.
In a statement, Binance acknowledged the scale of the breach and apologized for the disruption. The company emphasized that it had taken immediate action to contain the incident, strengthen its systems, and enhance security measures such as tighter device controls, improved wallet-service risk controls, and expanded AI anomaly detection.
Source: Breitbart
