Binance says fake job interviews and a malicious Google ad enabled a $6.3 billion crypto theft
Binance says a North Korean hacking unit, identified by the FBI as TraderTraitor, carried out what it calls the largest crypto theft to date — $6.3 billion — by chaining familiar techniques over several months. In June a developer downloaded a tampered installer delivered through a malicious Google ad, exposing how engineers work. Security teams detected that malware and replaced the worker’s device.
In September another engineer was cultivated through fake hiring: a series of calls, multiple interview rounds, and social media pages meant to build trust, then a job assignment that was actually malware. That second implant was not caught. It used obfuscation and evasion, deleting the legitimate pyenv executable and replacing it with a malicious version that ran commands and talked to an attacker-controlled server. The 0-day malware also hid activity and wiped traces, complicating investigation, and endpoint tools did not detect it at the time.
By October 20 the attackers used Binance’s own internal AI tool to gain control over wallets for the first compromised engineer and a third employee. On October 29 they logged into the third employee’s computer and launched the theft. Transfers continued for nearly two hours after the first unauthorized moves because the hot wallet used Multi-Party Computation (MPC), so there was no single private key to revoke the malicious EIP-7702 authorizations. Binance says it has blocked 57 suspected North Korea-linked cyber cases. CEO Richard Teng writes that no user is bearing the loss, about $2.85 billion in stolen assets has been frozen or intercepted, 98% of impacted tokens have been replenished with the remaining 2% underway, and withdrawals have broadly resumed. Why the internal AI tool helped, and why a long-warned interview-download risk succeeded here, remains thinly explained.
Continue in the app — vote & join in ➔