North Korean hackers used fake job interview to breach Binance
Original title: North Korean fake job interview led to $6.3B Binance heist
Binance engineer downloaded malware during fake job interview, enabling $6.3B theft via social engineering and AI tooling.
North Korean hackers tricked a Binance software engineer into downloading malware through a fake job interview process. The malware replaced a legitimate component on the work computer, allowing access to wallet infrastructure via compromised internal AI tools. The exchange rebuilt the system and is cooperating with law enforcement to trace stolen assets.
- Malware replaced pyenv component with malicious version
- Attack used container deployment on another engineer's computer
- All affected credentials and tokens decommissioned
Impact: Theft of cryptocurrency worth $6.3 billion
| Product | Affected |
|---|---|
| Binance wallet infrastructure | — |
- 1.Review endpoint security tools and AI tooling
- 2.Decommission compromised credentials
- ATT&CK
- T1566.002 Malicious LinkT1190 Exploit Public-Facing ApplicationT1203 Exploitation for Client Execution
- Vendors
- Binance
- Threat actors
- TraderTraitor
- Victims
- Binance
- Countries
- North Korea
From the original article
3 min read at theregister.com'It was not a single isolated breach or a simple phishing incident,' exchange says
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.