{
  "id": 18030993,
  "title": "North Korean fake job interview led to $6.3B Binance heist",
  "url": "https://urgent.news/2026/11/03/north-korean-fake-job-interview-led-to-6-3b-binance-heist-18030993",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T22:04:45.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/11/03/north-korean-fake-job-interview-led-to-63b-binance-heist/5307398"
  },
  "original_language": "en",
  "account": "North Korean cybercriminals orchestrated a multi-stage attack that culminated in a $6.3 billion heist from Binance, a leading cryptocurrency exchange. The sophisticated operation involved a deceitful job interview process, malware download, and compromised internal AI tooling. Initially, a Binance software engineer was tricked into downloading malware during a fake job interview, leading to the exposure of his role and colleagues on the wallet infrastructure team. Three months later, another engineer was contacted through a job-hunting platform by someone posing as a project director, arranging a series of interviews with a fake company. During the interviews, the attackers built trust by sharing personal information and eventually instructed the engineer to download a malware-infested code repository. The malicious script replaced a legitimate development tool component, enabling the attackers to execute commands and communicate with an external server. Later, the compromised computer was used alongside an internal AI tool to gain access to the computers of two other wallet engineers. The attackers then accessed one engineer's computer, used stolen credentials to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack on October 29. Binance has since rebuilt the compromised wallet system, replaced affected devices, decommissioned compromised credentials, and is collaborating with law enforcement and cybersecurity experts to trace and freeze the stolen assets.",
  "summary": "'It was not a single isolated breach or a simple phishing incident,' exchange says",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 6,
    "also_reported_by": [
      {
        "outlet": "Investing.com",
        "title": "Binance sees outflows stabilising as exchange returns online after $6.3 billion heist",
        "url": "https://urgent.news/2026/11/02/binance-sees-outflows-stabilising-as-exchange-returns-online-after-6",
        "published": "2026-11-02T02:24:25.000Z"
      },
      {
        "outlet": "Economic Times Tech",
        "title": "Binance sees outflows stabilising as exchange returns online after $6.3 billion heist",
        "url": "https://urgent.news/2026/11/02/binance-sees-outflows-stabilising-as-exchange-returns-online-after-6-17733526",
        "published": "2026-11-02T02:45:13.000Z"
      },
      {
        "outlet": "The Indian Express",
        "title": "Binance sees outflows stabilising as exchange returns online after $6.3 billion heist",
        "url": "https://urgent.news/2026/11/02/binance-sees-outflows-stabilising-as-exchange-returns-online-after-6-17737156",
        "published": "2026-11-02T03:42:46.000Z"
      },
      {
        "outlet": "Channel News Asia",
        "title": "Binance sees outflows stabilising as exchange returns online after US$6.3 billion heist",
        "url": "https://urgent.news/2026/11/02/binance-sees-outflows-stabilising-as-exchange-returns-online-after-us",
        "published": "2026-11-02T03:47:40.000Z"
      },
      {
        "outlet": "The Hindu - Sci-Tech",
        "title": "Binance sees outflows stabilising as exchange returns online after $6.3 billion heist",
        "url": "https://urgent.news/2026/11/02/binance-sees-outflows-stabilising-as-exchange-returns-online-after-6-17747156",
        "published": "2026-11-02T05:07:34.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}