North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack
The hackers posed as recruiters, convincing a Binance employee to download a fake "assignment" as part of a broader and sophisticated campaign.
North Korea executed a sophisticated $6.3 billion heist against Binance, employing a combination of social engineering tactics and malicious software. The hackers targeted a Binance engineer on LinkedIn, arranging a series of fake job interviews to deceive the employee into downloading an "assignment" that granted them access to the company's systems.
Another engineer was tricked into downloading a tampered version of a popular software package, Homebrew, which allowed the hackers to gather critical information about the engineer's role and others managing Binance's wallets. Binance flagged previous attempts by North Korean hackers to target its employees on LinkedIn and had prevented 57 North Korea-related hacking attempts in 2026.
After the incident, the company recovered around $2.5 billion from two companies, Tether and Circle, by freezing stolen stablecoins. Binance shut down withdrawals for 48 hours and later re-enabled them. The company has assured that customer funds are safe and has replenished 98% of the stolen coins from reserve funds and other sources, working to recover the remaining 2%.
Written by urgent.news from Fortune's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
