North Korean fake job interview led to $6.3B Binance heist

North Korean cybercriminals orchestrated a multi-stage attack that culminated in a $6.3 billion heist from Binance, a leading cryptocurrency exchange. The sophisticated operation involved a deceitful job interview process, malware download, and compromised internal AI tooling. Initially, a Binance software engineer was tricked into downloading malware during a fake job interview, leading to the exposure of his role and colleagues on the wallet infrastructure team.

Three months later, another engineer was contacted through a job-hunting platform by someone posing as a project director, arranging a series of interviews with a fake company. During the interviews, the attackers built trust by sharing personal information and eventually instructed the engineer to download a malware-infested code repository.

The malicious script replaced a legitimate development tool component, enabling the attackers to execute commands and communicate with an external server. Later, the compromised computer was used alongside an internal AI tool to gain access to the computers of two other wallet engineers. The attackers then accessed one engineer's computer, used stolen credentials to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack on October 29.

Binance has since rebuilt the compromised wallet system, replaced affected devices, decommissioned compromised credentials, and is collaborating with law enforcement and cybersecurity experts to trace and freeze the stolen assets.