Binance Details $6.3B Crypto Heist Linked to Fake Job Interview
Cryptocurrency exchange Binance has revealed that North Korean state-sponsored hackers utilized a sophisticated fake job interview and custom malware to compromise internal systems, resulting in a staggering $6.34 billion digital asset heist.
Radwan AbdulhadiEditor and technology writer
The Anatomy of the Breach
Cryptocurrency exchange Binance has released an incident report detailing how North Korean hackers used a deceptive recruitment scheme to compromise an employee and ultimately steal approximately $6.34 billion in digital assets during an October 29 crypto theft. According to BleepingComputer, the breach is part of a broader trend of targeted campaigns against cryptocurrency and software development personnel.
The attack traces back to September when a software engineer was approached via a professional job-hunting platform by individuals posing as a Project Director at a fictitious company. The employee's profile highlighted past experience at Binance, making them an attractive target for threat actors seeking access to cryptocurrency infrastructure. Further details are available from Lawrence Abrams in the original source material.
Fake Interviews and Zero-Day Malware
The threat actors arranged two separate interviews to build confidence. The first involved a live video call with a fake human resources representative who shared social media profiles containing personal photos and videos. The second interview directed the target to an online code repository to download a coding assignment.
Executing the repository's contents inadvertently infected the engineer's device with a custom, previously unseen zero-day malware that managed to evade endpoint security protection tools. Binance noted that the malware utilized advanced obfuscation techniques by substituting a legitimate development tool component with a compromised version, thereby opening communication with an external server controlled by the attacker.
Specifically, the script established a malicious replacement executable named pyenv_ inside the macOS Homebrew installation directory, deleted the legitimate pyenv executable, and spawned a Z shell process to execute remote commands.
Escalation to Wallet Infrastructure
By October 20, the attackers had leveraged the compromised engineer's computer alongside an internal AI tool to target two additional employees involved in Binance's wallet infrastructure. This granted them container deployment tokens and vital credentials.
On October 29, the hackers deployed a malicious script using those stolen credentials to breach Binance's wallet signing service. This unauthorized access enabled the transfer of billions of dollars across multiple blockchains. Furthermore, the attackers exploited Ethereum's EIP-7702 authorization mechanism, allowing them to sustain the theft even after the exchange temporarily halted user withdrawals.
The FBI previously attributed the attack to North Korean state-sponsored threat groups, linking the incident to actors historically tracked under various operational names.
Recovery and Ongoing Investigations
In the wake of the breach, Binance implemented extensive remediation steps, including rebuilding affected systems, replacing compromised hardware devices, and revoking all stolen credentials. Independent security firms have also been brought in to review the exchange's findings.
As security and recovery efforts moved forward, Binance reported that a substantial portion of the stolen funds was successfully frozen or intercepted, and the majority of impacted token assets were replenished. The exchange emphasized that it continues to investigate the multi-layered breach.
Sources
- BleepingComputerBinance says fake job interview led to $6.3 billion crypto heist
- The VergeBinance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist
Continue chronologically
Related stories
FBI Attributes Record $6.3B Binance Heist to North Korea
The FBI confirms North Korean hackers TraderTraitor carried out the $6.3 billion Binance crypto theft, marking the largest cryptocurrency heist ever.
FBI Flags Over 600 Addresses Tied to North Korea Binance Heist
The FBI flags over 600 crypto addresses linked to North Korean state-sponsored hackers following the record-breaking Binance breach.
Binance Hit by Record $6 Billion Crypto Heist
Blockchain intelligence firms attribute a record-breaking $6 billion theft from Binance wallets to North Korea's elite hacking unit, TraderTraitor.
Binance Resumes Withdrawals After $6.3 Billion Crypto Breach
Cryptocurrency exchange Binance has resumed withdrawals in a phased rollout following a massive $6.3 billion security breach, covering 95% of stolen assets.
