Binance says fake job interview lured engineer into $6.3 billion North Korean hack

Binance has confirmed that North Korean hackers pulled off a record $6.3 billion cryptocurrency theft after spending months building a fake recruitment approach that tricked an employee into installing malware. According to TechCrunch, the company disclosed in an updated statement on X that attackers relied on fabricated social media profiles and the promise of a job to reach inside the world's largest crypto exchange.

The heist, the largest crypto theft on record, forced Binance to suspend customer withdrawals across its network. The FBI and blockchain investigators have attributed it to North Korea, a country long accused of massive crypto thefts to fund its internationally sanctioned weapons program.

How the intrusion unfolded

In its own account, Binance said attackers posing as recruiters contacted a software engineer who works on wallets at the company. After two interviews with what appeared to be a legitimate firm, the engineer was asked to download a coding assignment as part of the hiring process. Opening the file executed malicious code that compromised the engineer's work-issued laptop, and Binance said its security tools did not detect the malware.

That initial foothold gave the attackers access to an internal tool capable of taking over the work computers of two other engineers on the wallet team. One of those engineers had separately downloaded a tampered application, found through a search engine, that contained password-stealing malware months earlier. Although Binance replaced that engineer's compromised laptop, the credentials already harvested were used to reach a third engineer, whose role included systems able to control billions of dollars in cryptocurrency.

A playbook researchers have flagged for years

The tactic is not new. Researchers and the U.S. government have warned for years that North Korean hackers impersonate venture capitalists, investors and recruiters, sometimes backed by dossiers of stolen American identities. TechCrunch notes that roughly half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers or fake recruiters, and that these schemes are widely known across the crypto industry.

Binance itself said it has faced at least 57 suspected attacks from North Korea, which it framed as evidence of a persistent state-sponsored campaign against the cryptocurrency sector.

Questions Binance left unanswered

Binance said the attack should never have happened, that it has since strengthened its network security, and that outside cybersecurity experts will review the incident. But key details remain unclear. According to TechCrunch, spokesperson Ross O'Leary declined to answer on-the-record questions about how Binance prevents unauthorized or malicious code from running on employee laptops, or whether any third party had audited its network security before the theft.

Investigators are likely to focus on two points: how the hackers persuaded an engineer at a high-profile target, given how well documented these campaigns are, and how the malware managed to bypass the company's defenses entirely.

Why it matters

The attack chain worked because each step looked ordinary. A recruiter reaching out, an interview process, a take-home coding exercise — these are routine events for developers, which is exactly what makes them effective as lure material. For employees, the practical takeaway is to treat unexpected job approaches and downloadable assignments with suspicion, and to run any such files only in isolated environments.

But the deeper lesson is organizational. TechCrunch points out that the ultimate responsibility sits with the company to ensure untrusted software cannot run on its systems. The initial laptop compromise only mattered because it could be chained into control of machines that move billions of dollars. Controls such as blocking unsigned executables, tightly segmenting access to high-value systems, and assuming that some employee will eventually click something are what stand between a single social-engineering success and a catastrophic loss.