North Korean fake job interview led to $6.3B Binance heist

Last week, North Korean hackers orchestrated a massive $6.3 billion heist from Binance's cryptocurrency exchange. The attack was the culmination of a multi-stage, sophisticated campaign, utilizing social engineering, malware downloads, compromised internal AI tooling, endpoint takeover, and an advanced transaction-authorization method. Binance's incident report published on Tuesday detailed the malicious activities, stating that the attack was not a single isolated breach but rather a series of interconnected breaches.

The cybercriminals, known as TraderTraitor and linked to North Korea's Lazarus Group, began preparations for the attack as early as June. They infiltrated Binance by tricking a software engineer into downloading malware during a fake job interview process. The incident report highlighted the deceptive nature of the social engineering techniques employed, including a convincing live video interview with a fake HR representative, who shared personal photos and videos to build trust.

The malware was designed to replace a legitimate development tool component with a malicious version, execute commands, and communicate with an attacker-controlled external server. This malware was installed on Binance's work-issued computer, allowing the attackers to gain access to the company's internal AI tool and compromise multiple wallets.

After months of planning, the hackers launched the attack on October 29, using compromised credentials to access Engineer C's computer. They then deployed a container, triggered a script to steal cryptocurrency, and stole $6.3 billion from Binance's wallets. Binance has since rebuilt its compromised wallet system, replaced all affected devices, and decommissioned all credentials and tokens assigned to the compromised engineers.

The exchange is collaborating with law enforcement, blockchain intel firms, and security researchers to trace and freeze the stolen assets.