Binance Details Recruitment Ruse Behind $6.3 Billion Crypto Theft
Binance says North Korean hackers stole $6.3 billion in cryptocurrency after using fake social-media profiles and a supposed job opportunity to compromise its network. The theft, which Binance says is the largest in crypto history, prompted the exchange to suspend customer withdrawals across its network.
In an updated statement posted on X, Binance described a months-long operation that began when attackers posing as recruiters contacted a software engineer working on wallets. The engineer completed two interviews with the purported company and was then asked to download an apparent coding assignment.
When the file was opened, it contained malicious code that compromised the employee's work-issued laptop. Binance said its security tools did not detect the malware. The FBI and blockchain investigators have attributed the heist to North Korea.
A recruitment lure became a route into wallet systems
Binance said the initial compromise gave the attackers access to an internal tool capable of taking over the work computers of two other engineers on the wallet team. One of those engineers had downloaded a tampered application containing password-stealing malware months earlier after locating the software through search results.
Although Binance replaced that engineer's laptop, the attackers retained stolen credentials. The company said those credentials were used to access the computer of a third engineer whose role provided access to systems capable of controlling billions of dollars in cryptocurrency.
The incident illustrates how several weaknesses can be combined: a malicious file disguised as an interview task, endpoint compromise, credential theft, and access to sensitive operational systems. Binance acknowledged that the attack should not have happened and said it has improved network security after the theft.
A long-running North Korean social-engineering pattern
Researchers, US government agencies and cybersecurity companies have repeatedly warned that North Korean operators impersonate recruiters, investors and venture capitalists to gain access to cryptocurrency businesses and wealthy targets. Such campaigns can rely on stolen American identities and persist for months.
Binance said it had faced at least 57 suspected attacks linked to North Korea, describing a persistent threat from state-sponsored actors targeting the cryptocurrency industry. The country has long been accused of using large cryptocurrency thefts to fund its internationally sanctioned nuclear weapons programme.
The company said it will bring in cybersecurity experts to review the incident and has introduced new measures intended to prevent a recurrence. Binance spokesperson Ross O’Leary referred to the public statement and did not answer questions about controls for preventing malicious or unauthorised code from running on employee laptops, or about prior third-party security audits.
What businesses should take from the incident
For organisations with privileged financial or infrastructure access, recruitment messages and take-home coding tasks must be treated as potential delivery mechanisms for malware. The practical implication is to limit execution of untrusted code on work devices, protect credentials, and ensure a single endpoint compromise cannot provide a path to systems with high-value authority.