Binance details $6.3 billion hack driven by fake job interviews and internal AI flaws
The exchange attributes the record-breaking theft to a North Korean group that exploited social engineering and a zero-day malware strain to steal funds from employee-linked wallets.
By Luis Medina ·
Binance has disclosed that a North Korean hacking unit stole $6.3 billion from its platform, marking the largest cryptocurrency theft in history. The exchange released a postmortem on November 3, detailing a multi-stage attack that began in June and culminated in a massive transfer on October 29.
The intrusion started when a developer installed a tampered software package found through a malicious Google ad. Binance stated that security teams detected this initial malware infection and replaced the affected device. However, the group returned in September by targeting a second engineer with a fake job application. The attackers conducted multiple interview calls and shared social media profiles to build trust before sending a fake interview assignment that contained new malware.
This second strain of malware replaced the pyenv executable with a malicious version, creating a backdoor to the network. Binance noted that its endpoint security tools failed to detect this zero-day threat because the code used advanced obfuscation techniques. The attackers also concealed their activity to hinder forensic analysis.
By October 20, the group, identified by the FBI as TraderTraitor, used Binance’s internal AI tool to take control of wallets belonging to the first compromised engineer and a third employee. On October 29, the hackers logged into the third employee’s computer and executed the theft. The exchange explained that it could not immediately stop the transfers because the hot wallet used Multi-Party Computation, meaning there was no single private key to revoke the malicious authorizations.
CEO Richard Teng stated that no user will bear the financial loss of the event. Approximately $2.85 billion in stolen assets have been frozen or intercepted. Teng reported that 98% of the impacted tokens had been replenished by the time of the announcement, with the exchange in the process of completing the remaining 2%. Withdrawal functions have largely resumed.
Binance claims it has previously prevented 57 suspected North Korea-linked cyber threats. The postmortem offers less clarity on why the specific attack vector succeeded. The company did not provide detailed information on the internal AI tool or why it allowed the attackers to gain control over the employee wallets. The risk of social engineering attacks via fake job interviews has been a known security concern in the technology industry for years.
