Binance's record $6.3B theft began with a fake job offer from North Korean hackers
Crypto exchange Binance has confirmed that North Korean hackers stole a record $6.3 billion in cryptocurrency last week. The attack began with a fake job offer sent to one of its engineers.
Binance, the world's largest cryptocurrency exchange, confirmed in an updated statement on X on Tuesday that North Korean hackers stole a record $6.3 billion in crypto last week. The exchange suspended customer withdrawals across its network after the incident. The FBI, the U.S. federal law enforcement agency, and blockchain investigators have blamed North Korea, which has long been accused of stealing cryptocurrency to fund its internationally sanctioned nuclear weapons program. It is the largest crypto theft in history.
How the attack unfolded
Binance says the hackers posed as recruiters and contacted a software engineer who works on wallets at the company. After two interviews, the engineer was told to download what looked like a coding assignment. It contained malicious code that compromised the engineer's work laptop, and Binance's security tools did not detect the malware.
From that foothold, the attackers reached an internal tool able to take over the work computers of two other engineers on the wallet team. One of them had months earlier unknowingly downloaded a tampered app containing password-stealing malware after searching for the software online. Binance replaced that engineer's laptop, but the hackers used the stolen credentials to break into the computer of a third engineer, whose role gave access to systems capable of controlling billions of dollars in crypto.
Earlier warnings and next steps
Researchers have warned for years that North Korean hackers pose as venture capitalists, investors and recruiters, using stolen American identities to trick employees into granting access. Roughly half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters. By Binance's own account, it has faced at least 57 suspected North Korean attacks.
Binance said the attack "should not have happened" and that it plans to bring in cybersecurity experts to review the incident. The company says it has introduced new security measures. Spokesperson Ross O'Leary declined on the record to answer TechCrunch's questions about how Binance prevents malicious code from running on employee laptops and whether third parties had audited its network before the hack.
