Binance reveals North Korean hackers stole $6.3 billion through fake job interview

Binance detailed the timeline of the world's largest cyber heist in an assessment released on Tuesday. The crypto exchange identified the attackers as TraderTraitor, a North Korean military unit that the Federal Bureau of Investigation has linked to the theft of $6.3 billion. This sum represents the largest amount of money ever stolen in a single digital attack.

The intrusion began months before the final theft. Binance stated that hackers first tested the security systems in June. The exchange detected that initial attempt and stopped the access. However, the effort gave the attackers useful information about the platform's internal structure. They returned in September with a more sophisticated plan.

A Binance engineer received a message on a job hunting platform from a recruiter claiming to be a project director at a fictitious company. The engineer met with a supposed human resources representative for a first round interview. The fake interviewer shared personal photos and social media accounts to build trust with the employee. Binance described this tactic as more advanced than previously seen social engineering approaches.

The engineer was then scheduled for a second interview with the supposed CEO via a popular social chat app. During this conversation, the hacker asked the employee to download an assignment as part of the recruitment process. The employee was using his work laptop at the time. The downloaded file contained malicious code that allowed the hackers to establish a foothold in the system.

The attack culminated last week when the hackers moved over $6 billion in cryptocurrency out of customer accounts. Binance said the entire theft process took approximately twenty minutes to execute. The company noted that the initial infection had been in place for months before the final payout.

Binance stated on Monday that it had replaced most of the stolen assets using its own funds to cover customer losses. The company is also conducting an independent cybersecurity review to prevent future incidents. In its Tuesday statement, Binance apologized for the disruption and uncertainty caused to users and partners.

The exchange acknowledged that the incident should not have occurred. It highlighted the deceptive nature of the fake job interview as the primary vector for the breach. The assessment serves as a formal record of how the North Korean unit bypassed security protocols to execute the heist.