Binance details how fake job interview led to $6.3 billion crypto theft
FBI identifies North Korean unit TraderTraitor as the actor behind the exchange's largest security breach.
By Marta Gray ·
Binance released an initial assessment on Tuesday explaining how a multi-month social engineering campaign led to the theft of $6.3 billion in customer funds. The exchange stated that the attack, carried out by a North Korean state-sponsored unit, was executed over a period of roughly twenty minutes but required extensive preparatory work over several months.
The timeline of the intrusion began in June when the hackers first attempted to penetrate Binance's security systems. Although the exchange detected and stopped that initial probe, the interaction provided the attackers with valuable intelligence regarding Binance's infrastructure. This early reconnaissance allowed the group to refine their strategy for a subsequent, more sophisticated attempt.
In September, the operation shifted to human deception. A Binance engineer was contacted on a job-hunting platform by an individual posing as a project director for a fictitious company. The hacker conducted a preliminary interview with the engineer while pretending to be an HR representative. During this session, the impersonator shared social media profiles, personal photos, and videos to establish credibility and trust with the employee.
Binance described this phase of the attack as more advanced and deceptive than previous social engineering tactics observed in the industry. The process moved to a second interview stage where the engineer was scheduled to meet with the supposed CEO of the fake firm via a popular social chat application. The engineer was working on his company laptop during this virtual meeting.
The compromise occurred when the interviewer asked the engineer to download a file described as a job assignment. The file contained malicious code that allowed the hackers to stage the final attack. Last week, the group exploited this foothold to drain over $6 billion in cryptocurrency assets from Binance's customer holdings.
The FBI has identified the perpetrators as TraderTraitor, a North Korean military unit. In response to the breach, Binance announced that it has replaced most of the stolen currencies using its own funds. The company also stated it is conducting an independent cybersecurity review to prevent similar incidents in the future.
In its written assessment, Binance acknowledged the failure and apologized to users, partners, and the wider industry for the disruption and uncertainty caused by the event. The exchange noted that the incident should not have happened and detailed the specific steps taken to secure its systems following the discovery of the intrusion.
