Binance details malware and recruitment scam in $6.3bn hack

Binance has disclosed that the hackers responsible for the $6.3bn (£4.7bn) cryptocurrency heist employed a combination of malicious software and a fraudulent recruitment process to breach its systems. The world’s largest crypto exchange stated that the operation began in June with an inadvertent malware download, escalated through a job interview scam in September, and culminated in the theft of billions of dollars from hot wallets last week.

According to a company update released on Tuesday, the initial foothold was established when an engineer accidentally downloaded malware. This incident exposed the roles of the employee and other team members responsible for Binance’s cryptowallet infrastructure. Subsequently, a fake project director contacted a different engineer via a legitimate job-hunting platform. This led to a first-round video interview with a sham human resources representative and a second-round interview on a chat application with the alleged chief executive of a fictitious company. During this second interaction, the engineer was tricked into installing malware on their computer.

On 20 October, the attacker leveraged the compromised device and an internal artificial intelligence tool to seize control of the engineer’s system and that of a second wallet developer on the same team. The final stage of the attack occurred on 29 October, when the intruder used the second developer’s computer, utilising stolen credentials from the first engineer, to execute a malicious script that drained the funds. Binance confirmed that $2.85bn of the total $6.34bn taken from the cryptowallets has been frozen or intercepted.

The Federal Bureau of Investigation has attributed the hack to North Korea, a state frequently linked to cybercrime. However, Pyongyang has dismissed the accusation. Kim Yo-jong, the sister of leader Kim Jong-un, described the US claims as absurd rhetoric and a grave political provocation on Tuesday. Speaking through the state news agency KCNA, she asserted that Washington was attempting to brand the Democratic People’s Republic of Korea as a cybercriminal state by misleading international public opinion.

Binance acknowledged the severity of the breach, stating that the incident should not have happened. The company apologised for the concern, disruption and uncertainty caused to its users, partners and the wider industry, while noting that deepfake job interviews are a recognised tactic in North Korea’s cyber arsenal, though typically used to funnel money back to the state rather than to steal assets.