Fake Job Interviews and Rogue Downloads: How a Months-Long Campaign Led to a $6.3 Billion Binance Theft

Cryptocurrency exchange Binance says a months-long campaign by North Korean hackers led to the theft of $6.3 billion last week. In a post-mortem, the company said the attack began in June and involved multiple employee devices. CEO Richard Teng said it was not the result of "one mistake or one breach". Binance described a multi-stage operation that combined social engineering through fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise and an advanced transaction-authorisation method. North Korea has denied responsibility.

Investigators said the first step came in June, when an engineer downloaded malicious software while trying to install a popular AI coding tool. Binance's security team detected it and replaced the device, but the attackers had already gained key information about the engineer and the wider developer team. By September, a software engineer approached with a fake job offer was told during a second interview to download an assignment containing a malicious code repository. That download started the attack that led to the theft, giving the hackers access to Binance systems and the ability to swap legitimate tools for malicious ones.

Binance said its endpoint security tools did not detect the malware, and the attacker removed traces of the initial compromise. The company also said it has stopped 57 separate attempts by North Korean actors this year, using fake job offers, malware disguised as developer tools, compromised browser extensions and malicious video conferencing tools.