Fake Job Interview Helped North Korean Hackers Pull Off Record $6.3 Billion Binance Heist

Binance has published an incident report saying the record $6.3 billion theft was not a single breach or a simple phishing incident. The exchange describes a sophisticated, multi-stage campaign that combined social engineering through fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover and an advanced transaction-authorization method. The FBI has attributed the theft to TraderTraitor, a North Korean operation linked to Lazarus Group.

According to the report, preparation began in June, when one engineer downloaded a malicious Homebrew installation in a supply chain attack. Binance's security team detected the malware, replaced the device and rotated all affected credentials. Even so, the report says that engineer and colleagues on the wallet infrastructure team were exposed to the attacker.

The social engineering phase followed in September. Another software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director, who arranged a series of interviews with a fake company. In the first round, a live video interview with a fake HR representative, the interviewer shared a social media account with personal photos and videos to build trust. Binance called this more advanced and deceptive than previous social engineering approaches. The report says the engineer was tricked into downloading malware onto a work-issued computer. This article covers only the opening of the source report, not the full story.