Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

Fake interview campaign leads to major Binance crypto heist

Part of the Binance story · since 30 Oct

Developinglatest 17 minutes ago24 articles11 outlets
30 Oct · Security Affairs first2 Nov3 NovNowThis article22nd of 24
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist. This article, 22nd of 24.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.

Threat actors carried out a months-long campaign targeting multiple Binance software engineers using sophisticated social engineering and zero-day malware, culminating in a record-breaking digital heist. Binance described the operation as more than a simple phishing incident, noting a blend of techniques including fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorisation method.

The intrusion began with an interview set up via a legitimate job-hunting platform with an unnamed “Software Engineer B”; a fake HR representative cultivated trust and closer contact, culminating in an instruction to download an “assignment” containing a malicious code repository that executed during setup and connected to a C2 server.

The attack progressed when the hackers used Engineer B’s machine to access an internal AI tool and compromise two other Binance employees: Wallet DevOps Engineer A and Wallet Software Engineer C. Engineer A had previously been targeted in June after downloading a malicious Homebrew version via a malicious search ad. On 29 October, between 17:15 and 19:56 UTC, the attacker logged onto Engineer C’s machine using credentials stolen from Engineer A, deployed a container and triggered a malicious script.

Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker-controlled address, with additional transfers of around 970,500 SOL and 44.2 million OP to attacker-controlled addresses. Binance says it rebuilt the wallet system and AI tool, replaced affected devices, rotated credentials, and bolstered monitoring and risk controls, while noting it has already detected and blocked 57 suspected North Korean attacks this year.

How the story developed

All 24 articles
Developinglatest 17 minutes ago24 articles11 outlets

24 articles from 11 outlets since 30 Oct. Still developing; the latest report was 17 minutes ago. This was the 22nd report, 5 days after the first.

Now30 Oct311 Nov234First reportSecurity Affairs · 30 Oct, 00:30This article22nd of 24 · day 5
  • Fri 30 Oct, 00:30 UTC. Security Affairs, first report. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion.
  • Fri 30 Oct, 02:00 UTC. SecurityOnline, its first report on the story. Binance investigates suspected hot wallet breach and transfers.
  • Fri 30 Oct, 06:00 UTC. The Hacker News, its first report on the story. Binance reports breach affecting $6.3 billion in assets.
  • Fri 30 Oct, 08:30 UTC. SecurityWeek, its first report on the story. North Korea’s TraderTraitor linked to $6.36 billion Binance heist.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Binance probe traces $6.36 billion hack to DevOps breach.
  • Fri 30 Oct, 09:30 UTC. SOCRadar, its first report on the story. Binance reports $6.3 billion theft from its hot wallets.
  • Fri 30 Oct, 12:00 UTC. Infosecurity, its first report on the story. Analysts attribute Binance’s $6.3bn hack to North Korean group.
  • Fri 30 Oct, 13:00 UTC. Malwarebytes, its first report on the story. Binance reports $6.3 billion theft linked to North Korean group.
  • Fri 30 Oct, 14:30 UTC. Ars Technica, its first report on the story. TRM Labs links record $6.3 billion Binance heist to North Korea.
  • Fri 30 Oct, 19:30 UTC. Security Affairs. TRM Labs attributes $6.3 billion Binance theft to North Korea.
  • Fri 30 Oct, 23:00 UTC. StepSecurity, its first report on the story. Binance hack highlights risks to developer machines and signing.
  • Sun 1 Nov, 08:30 UTC. The Hacker News. FBI blames North Korea group for $6.43 billion Binance heist.
  • Sun 1 Nov, 09:55 UTC. cybersixt, its first report on the story. How North Korea is laundering $6.4 billion stolen from Binance.
  • Sun 1 Nov, 20:30 UTC. Security Affairs. FBI blames North Korea linked group for Binance theft.
  • Mon 2 Nov, 09:30 UTC. SecurityWeek. FBI Links North Korea’s TraderTraitor to Binance Heist.
  • Mon 2 Nov, 11:00 UTC. Infosecurity. FBI links Binance crypto breach to North Korea’s TraderTraitor.
  • Mon 2 Nov, 23:30 UTC. Dark Reading, its first report on the story. Binance Hack Shows How One Laptop Led to Billions in Losses.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. FBI attributes $6.3 billion Binance heist to North Korea.
  • Tue 3 Nov, 18:00 UTC. The Hacker News. Binance Details How Fake Interviews Led to $6.43 Billion Theft.
  • Tue 3 Nov, 20:30 UTC. Security Affairs. Binance details how fake job interviews enabled a $6.34B hack.
  • Wed 4 Nov, 02:00 UTC. SecurityOnline. FBI links Binance wallet theft to North Korean actors.
  • Wed 4 Nov, 10:00 UTC. Infosecurity. Fake interview campaign leads to major Binance crypto heist. This article, 22nd of 24.
  • Wed 4 Nov, 10:00 UTC. SecurityWeek. North Korea protests US claims linking hackers to Binance heist.
  • Wed 4 Nov, 11:30 UTC. SecurityWeek. Binance details $6.34 billion theft linked to North Korean group.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 24 articles as a list
  1. Fri 30 OctDay 011
    1. Binance Investigates Suspicious Crypto Transfers Worth $5.8 Billion00:30 · Security Affairs · First report
    2. Binance investigates suspected hot wallet breach and transfers02:00 · SecurityOnline
    3. Binance reports breach affecting $6.3 billion in assets06:00 · The Hacker News
    Show 8 more from 30 Oct
    1. North Korea’s TraderTraitor linked to $6.36 billion Binance heist08:30 · SecurityWeek
    2. Binance probe traces $6.36 billion hack to DevOps breach09:00 · SecurityOnline
    3. Binance reports $6.3 billion theft from its hot wallets09:30 · SOCRadar
    4. Analysts attribute Binance’s $6.3bn hack to North Korean group12:00 · Infosecurity
    5. Binance reports $6.3 billion theft linked to North Korean group13:00 · Malwarebytes
    6. TRM Labs links record $6.3 billion Binance heist to North Korea14:30 · Ars Technica
    7. TRM Labs attributes $6.3 billion Binance theft to North Korea19:30 · Security Affairs
    8. Binance hack highlights risks to developer machines and signing23:00 · StepSecurity
  2. Sun 1 NovDay 23
    1. FBI blames North Korea group for $6.43 billion Binance heist08:30 · The Hacker News
    2. How North Korea is laundering $6.4 billion stolen from Binance09:55 · cybersixt
    3. FBI blames North Korea linked group for Binance theft20:30 · Security Affairs
  3. Mon 2 NovDay 33
    1. FBI Links North Korea’s TraderTraitor to Binance Heist09:30 · SecurityWeek
    2. FBI links Binance crypto breach to North Korea’s TraderTraitor11:00 · Infosecurity
    3. Binance Hack Shows How One Laptop Led to Billions in Losses23:30 · Dark Reading
  4. Tue 3 NovDay 43
    1. FBI attributes $6.3 billion Binance heist to North Korea10:30 · SecurityOnline
    2. Binance Details How Fake Interviews Led to $6.43 Billion Theft18:00 · The Hacker News
    3. Binance details how fake job interviews enabled a $6.34B hack20:30 · Security Affairs
  5. Wed 4 NovDay 54
    1. FBI links Binance wallet theft to North Korean actors02:00 · SecurityOnline
    2. Fake interview campaign leads to major Binance crypto heist10:00 · Infosecurity · This article, 22nd of 24
    3. North Korea protests US claims linking hackers to Binance heist10:00 · SecurityWeek
    4. Binance details $6.34 billion theft linked to North Korean group11:30 · SecurityWeek

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in