{
  "id": 17203366,
  "title": "North Korea’s hiring scam just cost Binance US$6.3B. SEA’s engineers are on the shortlist",
  "url": "https://urgent.news/2026/10/30/north-koreas-hiring-scam-just-cost-binance-us-6-3b-seas-engineers-are",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-30T09:04:26.000Z",
  "source": {
    "name": "e27",
    "slug": "e27",
    "url": "https://e27.co/north-koreas-hiring-scam-just-cost-binance-us6-3b-seas-engineers-are-on-the-shortlist-20261030/"
  },
  "original_language": "en",
  "account": "North Korea allegedly breached a single DevOps engineer's laptop, which led to unauthorized withdrawals amounting to approximately US$6.3 billion on Binance, the world's largest crypto exchange. This incident is considered four times more severe than the US$1.5 billion Bybit heist in February 2025 and has resulted in about US$3 billion in frozen assets. Chainalysis and TRM Labs attribute the attack to North Korea's state-backed cluster known as \"TraderTraitor.\" Binance claims there is no evidence that wallet private keys were leaked, but this reassurance may be misleading, as the attacker did not need the keys to carry out the operation. Thailand's Binance subsidiary, Gulf Binance, holds Thai Securities Exchange licences and keeps its cold wallets separately, yet the exchange suspended crypto transactions for security checks within hours of the attack. This suggests that while ring-fencing protected assets, it didn't prevent access or maintain confidence. The incident highlights the importance of assessing not just where funds are stored, but who can move them. Southeast Asian markets, particularly Vietnam, Indonesia, and the Philippines, are growing in popularity due to their retail user base and role as remittance, gaming currency, and savings accounts. These markets, however, lack automatic insurance for exchange-held funds. Binance has promised to cover all losses, but smaller exchanges in the region might not be able to do so. The attack pattern in Southeast Asia has been consistent: employee recruitment through LinkedIn, a coding test on GitHub, and malware distribution via a developer's curiosity. The attackers leverage the region's availability of remote, well-paid engineers, making it an attractive target. The response to the breach has been swift, with private companies like Tether and Circle freezing stolen stablecoins, but the issue remains that regulators in Thailand, Indonesia, and the Philippines do not have the power to act on such matters. The article suggests that regulatory bodies should focus on the individuals responsible for custody, including their access controls, red-team testing for phishing scenarios, and ensuring local subsidiaries can manage withdrawals even when the parent company freezes operations. Incident disclosure should also be prompt, in local languages, and uniformly communicated.",
  "summary": "For years, Southeast Asia’s crypto regulators have asked exchanges the same set of questions. Where is your licence? Where is your local entity? Where are your cold wallets, and whose name is on them? On October 29, North Korea answered with a question of its own: whose laptop is this? Binance, the world’s largest crypto […] The post North Korea’s hiring scam just cost Binance US$6.3B. SEA’s…",
  "key_points": [],
  "editors_take": "Targeting remote engineering talent through deceptive recruitment processes exposes a critical vulnerability in how global exchanges manage human access controls and protect assets from state-backed cyber threats.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}