Binance says last week's record $6.3 billion crypto theft involved a fake job interview. In an updated statement on Tuesday, the world's largest crypto exchange set out how the attackers worked their way into its systems over several months before the theft on 29 October. It remains the largest crypto theft in history.
How the fake interview worked
In September, a Binance software engineer was contacted through a legitimate job-hunting platform by someone posing as a project director at a fictitious company. The fake recruiter set up two interviews, first with someone pretending to work in human resources, then with someone claiming to be the company's CEO. In the second, the engineer was told to download a coding assignment from an online code repository. It was actually malware, and Binance's security tools didn't detect it.
It wasn't the first way in. In June, another developer had downloaded a tampered installer, apparently spread through a malicious Google ad, which exposed details about the engineers and how they work. Binance says its security team caught that one and replaced the worker's device. By 20 October, the attackers had used the September engineer's computer and Binance's own internal AI tool to compromise two more employees working on its wallets, obtaining their credentials. On 29 October, they used those credentials to get into Binance's wallet signing service and move billions of dollars across multiple blockchains.
The FBI says the hackers are from North Korea, from a state-sponsored group known as TraderTraitor. Fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns, and Binance says it has faced at least 57 suspected attacks from the country.
What Binance has recovered
Binance says about $2.85 billion has been frozen or intercepted. Withdrawals have resumed in phases, and the company says it has now covered 95% of the stolen assets, while it works to buy the rest, which take longer to source. It says the losses won't be passed on to users. Binance has admitted the attack "should not have happened", and says it has rebuilt affected systems, replaced compromised devices and revoked stolen credentials. The way in wasn't a flaw in its code, but a job offer.
