Binance details $6.3 billion theft that began with a fake job interview

Cryptocurrency exchanges face a growing threat from sophisticated state actors, but few breaches have matched the scale of the recent attack on Binance. The company has released a detailed postmortem regarding a $6.3 billion theft, which it describes as the largest crypto heist in history.

Binance states the campaign began in June when a developer downloaded a tampered installer. This file was distributed through a malicious Google ad. The initial intrusion gave attackers access to internal engineering details. Security teams found the first malware infection and replaced the worker's device. However, the attackers returned in September with a new target.

A second engineer was approached by an individual posing as a recruiter. The attacker conducted multiple interview calls and shared social media profiles to build trust. They eventually sent a fake assignment file that contained malware. This second infection slipped past endpoint security tools. The malware replaced a standard executable with a malicious version, creating a backdoor. The attackers also deleted traces of the compromise to hinder investigation.

The FBI has identified the group behind the attack as a North Korean unit named TraderTraitor. By October 20, the hackers used Binance's internal AI tool to control wallets belonging to the engineer compromised in June and a third employee. On October 29, the attackers logged into the third employee's computer to launch the final transfer. The postmortem notes that the hot wallet used Multi-Party Computation, meaning no single key could immediately revoke the malicious authorizations. This technical detail explains why the exchange could not stop the transfers for nearly two hours after the first unauthorized movement.

CEO Richard Teng stated that no user is bearing the financial loss. The company has frozen or intercepted approximately $2.85 billion in stolen assets. Teng added that 98% of the impacted tokens have been replenished, with the remaining 2% in the process of being completed. Withdrawals have largely resumed for customers. Binance claims it has prevented 57 other suspected North Korea-linked cyber threat cases recently.

The report leaves some gaps in the explanation. It offers little detail on the specific internal AI tool the attackers exploited or why it facilitated their access. The use of job interview schemes to deploy malware is a known tactic that has been warned about for years. The postmortem does not fully explain why this particular social engineering attempt succeeded where previous attempts may have failed.

The company says the attackers concealed their activities by removing traces of the compromise. This made later detection and investigation more difficult. The timeline spans from the initial June intrusion to the final October transfer. The total amount stolen is $6.3 billion. The attackers are a North Korean unit. The breach involved a fake job interview. The malware replaced a system executable. The hot wallet structure delayed the response. Most funds are now recovered. Withdrawals are open. The internal AI tool remains a point of inquiry.