Binance details 6.34 billion dollar theft following fake job interviews and malware

Cryptocurrency exchange Binance has revealed how North Korean attackers spent months preparing a sophisticated multi-stage campaign to steal approximately 6.34 billion dollars in virtual assets. The October cyberattack compromised internal systems through social engineering and developer software.

Qisqacha

• Hackers compromised engineers using a fake Homebrew installation and a recruitment scam.
• Attackers gained access to internal wallet signing systems on October 29.
• The U.S. FBI officially attributed the multi-billion dollar heist to North Korea.
• Binance successfully froze 2.85 billion dollars and replenished 98% of funds.

Initial system compromises via social engineering

The first breach occurred in June when a Wallet DevOps engineer downloaded a malicious Homebrew package manager after searching for an AI coding tool. Although Binance replaced the device and rotated credentials, attackers had already identified key wallet infrastructure personnel.

A second vector unfolded in September through a fake recruitment process where actors posed as project directors and HR representatives. After video interviews, the engineer was tricked into downloading a coding assignment containing a malicious repository.

Execution of the theft and internal access

The malware replaced a Python version-management tool component, evading endpoint security tools. By October 20, attackers leveraged the compromised computers and an internal AI tool to control two wallet engineers' devices and deployment tokens.

On October 29, the actors utilized stolen credentials to execute a script that granted access to Binance's internal wallet signing service. This allowed unauthorized transactions from five hot wallets outside standard withdrawal protocols.

Official responses and industry implications

On November 1, the U.S. FBI formally attributed the cyber theft to North Korea's TraderTraitor activity, drawing comparisons to previous Lazarus group campaigns targeting developers with fake job offers and obfuscated malware.

Binance stated that it has since frozen or intercepted approximately 2.85 billion dollars in compromised assets, while 98 percent of the affected user funds have been fully replenished from the exchange's internal reserves.