Binance disclosed a $6.3 billion cryptocurrency theft involving social engineering, fake recruitment processes, and malicious software targeting employees.
Binance disclosed on Tuesday that a "sophisticated, multi-stage campaign" resulted in the theft of approximately $6.3 billion in cryptocurrency, which the company attributes to North Korean hackers.
According to Binance, the breach began in June when an employee downloaded a tampered version of a software package, which was promoted through an internet advertisement. While Binance detected the download and replaced the device and credentials, the attackers successfully learned the roles of the employee and other members of the wallet team.
In September, the campaign escalated through social engineering. A software engineer was contacted on a legitimate job-hunting platform by an individual posing as a Project Director. The engineer participated in a first-round interview with a purported HR representative and a second-round interview with an individual claiming to be the CEO of a fictitious company. During this process, the engineer was instructed to download a coding assignment that contained a "malicious code repository."
On October 20, the attackers used the compromised computer and an internal AI tool to gain control over the systems of two other engineers, including a Wallet DevOps Engineer. The attackers discovered a container deployment permission token on the computer of Wallet DevOps Engineer A.
On October 29, the attackers used the stolen credentials and a malicious script to launch the final attack. The theft involved the removal of assets from five Binance hot wallets. Binance reported that the attackers used 50 signing transactions to manipulate the account.
Regarding the financial impact:
The FBI has attributed the breach to North Korean hackers, specifically a group known as TraderTraitor. North Korea has denied these claims, calling the accusation a "grave political provocation."
In response to the incident, Binance temporarily suspended withdrawals for approximately 48 hours before re-enabling them on Saturday. The company stated it has closed the identified entry points, rebuilt affected systems, and is increasing investment in AI-enabled detection.
This incident highlights the growing use of social engineering and "trojanized" developer tools to bypass traditional security perimeters. By targeting the human element through fake recruitment, attackers were able to move laterally through the network using internal AI tools and privileged credentials.
Sources
This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.
The day's checked news, by email
One short email a day with the top stories. Free, and you can unsubscribe in one click.
Or follow for the latest news:
No comments yet. Start the discussion.
BusinessTrending
Super Micro reported fiscal Q1 2027 revenue of $19.95 billion and earnings per share of $1.81, exceeding both Wall Street projections and preliminary guidance.
BusinessTrending
Supermicro reported fiscal first quarter revenue of $19.95 billion and announced a strategic partnership with SambaNova to develop AI inference systems.
