Binance: Fake Job Interview Facilitates $6.3 Billion North Korean Hack

The total loss from last week’s cyberattack on the cryptocurrency exchange Binance reached $6.3 billion, a sum that represents the largest digital heist in history. The exchange released an initial assessment on Tuesday detailing how the breach unfolded in a rapid sequence of events that occurred over approximately twenty minutes.

The operation was led by a North Korean military unit identified by the FBI as TraderTraitor. According to the report, the hackers began probing Binance’s security infrastructure in June. While the exchange detected and blocked that initial attempt, the intrusion provided the attackers with valuable intelligence about the company’s internal systems.

In September, the attackers escalated their tactics through a sophisticated social engineering campaign. They contacted a Binance engineer through a job-hunting platform, posing as a project director for a fictitious company. The hacker then conducted a first-round interview with the engineer, acting as a human resources representative. During this call, the attacker shared fake social media accounts, personal photos, and videos to establish credibility and trust with the employee.

Binance described this multi-step approach as more advanced and deceptive than previously seen methods. The process culminated in a second interview scheduled with the supposed CEO via a popular social chat application. The engineer, working from his corporate laptop, was instructed to download a file labeled as a job assignment. This file contained malicious code that allowed the hackers to construct a pathway into the exchange’s core systems.

The stolen funds were extracted from customer accounts held within the platform. In response to the crisis, Binance stated on Monday that it had replaced the majority of the stolen cryptocurrency using its own reserves. The company is currently conducting an independent cybersecurity review to address vulnerabilities. In its Tuesday statement, Binance admitted that the incident should not have occurred and apologized for the disruption caused to users, partners, and the industry.