Binance's $6.3 Billion Heist: A Masterclass in Basic Social Engineering
AI-generated image · US National Wire
The world's largest crypto exchange claims a 'sophisticated' attack, but the playbook is one researchers have warned about for years.
Binance has confirmed that North Korean hackers stole a record $6.3 billion in cryptocurrency last week, the largest theft in the industry's history. While Binance described the October 29 breach as a "sophisticated, multi-stage campaign," the tactics used are widely known.
Reporting from TechCrunch notes that researchers and the U.S. government have warned for years about North Korean actors posing as recruiters and venture capitalists to trick employees into granting system access. According to TechCrunch, roughly half of all intrusions at U.S. tech companies last year involved North Koreans posing as fake recruiters or remote IT workers.
As detailed by The Register, the attack began in June when an engineer downloaded a malicious Homebrew installation. By September, hackers targeted another software engineer via a job-hunting platform. After a video interview and a chat with a fake CEO, the engineer was tricked into downloading a malware-laced "assignment" onto a work-issued laptop.
Binance admitted its security tools failed to detect the malware. This foothold allowed attackers to use an internal AI tool to compromise two additional engineers on the wallet team. By stealing credentials and deployment tokens, the hackers eventually accessed systems capable of controlling billions in assets.
Following the heist, Binance suspended customer withdrawals and has since rebuilt the compromised wallet system and internal AI tool. The FBI and blockchain investigators attributed the attack to TraderTraitor, a North Korean operation linked to the Lazarus Group. Binance says it is now working with independent cybersecurity experts to review the incident.