Binance Reveals Hackers Used Fake Job Interviews to Steal $6.3 Billion

Binance published an initial assessment on Tuesday detailing how hackers stole $6.3 billion in cryptocurrency from the exchange. The company identified the attackers as a North Korean state-sponsored military unit known as TraderTraitor. The review indicates that the successful breach was the culmination of a multi-month campaign that began in June.

The attackers first attempted to penetrate Binance's security systems in June. The exchange detected and stopped that initial probe. However, the attempt gave the hackers enough information to refine their approach for a later attack.

In September, the group shifted to a social engineering strategy. They contacted a Binance engineer through a job-hunting platform using the profile of a fictitious company. A person posing as a project director from this fake company reached out to the engineer. The engineer proceeded with a first-round interview with a supposed human resources representative.

During the first interview, the fake interviewer shared social media accounts, personal photos, and videos to build trust with the employee. Binance described this method as more advanced and deceptive than previously seen social engineering approaches. The exchange noted that the interaction was designed to lower the engineer's guard.

The group then scheduled a second interview with the supposed CEO of the fictitious company. This conversation took place on a popular social chat application. At the time, the engineer was working on his company laptop. The fake CEO asked the employee to download an assignment file as part of the recruitment process.

The file contained malicious code. This code allowed the hackers to build an attack that was executed last week. During that window, the group transferred over $6 billion in customer-held cryptocurrency out of the exchange. The entire execution of the final theft lasted approximately twenty minutes.

Binance stated that it has replaced most of the stolen customer funds using its own money. The company is also conducting an independent cybersecurity review. In its statement posted on X, Binance apologized for the disruption and uncertainty caused to users, partners, and the industry. The exchange wrote that the incident should not have happened.