朝鲜虚假求职面试导致 Binance 发生 63 亿美元加密货币盗窃案

Jump to main content

TOPICS

Security
- All Security
- Cyber-crime
- Patches
- Research
- CSO
Off-Prem
On-Prem
- All On-Prem
- Systems
- Storage
- Networks
- HPC
- Personal Tech
- Cx0
- Public Sector
Software
Offbeat
- All Offbeat
- Columnists
- Anthropic
- BOFH
- Legal
- Site News
- About Us
Special Features
Vendor Voice
Resources

REG AD

security

North Korean fake job interview led to $6.3B Binance heist

'It was not a single isolated breach or a simple phishing incident,' exchange says

Jessica LyonsJessica LyonsCybersecurity Editor

Published Tue 03 Nov 2026 // 22:04 UTC

Make us preferred on Google

North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week's record-breaking $6.3 billion heist.

In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach.

“Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. “It was not a single isolated breach or a simple phishing incident.”

REG AD

Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams - both posing as IT workers, who are then hired by Western companies, and as potential employers to lure software engineers into downloading malware and infecting corporate devices.

REG AD

With the recent Binance attack, the Norks used the latter.

The attack prep began back in June with a supply chain attack when one of its engineers downloaded a malicious Homebrew installation. While the malware was detected by the security team, the device was replaced, and all affected credentials rotated, “Engineer A’s role and his related colleagues on our wallet infrastructure team was exposed to the hacker,” the report says.

Three months later, the social engineering part of the attack happened.

In September, another software engineer was contacted via a “legitimate job-hunting platform” by someone purporting to be a project director who arranged a series of job interviews for the Binance engineer with the fake company. During the first round - a live video interview with the engineer and a fake HR rep - the interviewer “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” according to the report. “This was more advanced and deceptive than previously seen social engineering approaches.”

The second interview with someone purporting to be the CEO of the phony company was conducted on a “popular social chat app,” and toward the end, the CEO instructed the engineer to download an “assignment” containing a malware-laced code repository. The code executed on his work computer during the setup process, which kicked off a series of unauthorized activities.

According to Binance, the malware replaced a legitimate development tool component with a malicious version, which executed commands and established communication with an attacker-controlled external server. The attackers also took steps to hide the malicious script and evade detection, and it worked. Binance’s endpoint security tools did not immediately detect the malware.

Here’s the script:

CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_

REG AD

MODIFY pyenv_ → 3,414 B

DELETE .../libexec/pyenv (3,344 B) ← remove the valid pyenv

RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version

DELETE /opt/homebrew/bin/pyenv (3,414 B)

ln (create a new symlink) + spawn zsh

Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C.

Engineer A had a container deployment permission token on his computer, which the Norks soon discovered. On October 29, the attacker accessed Engineer C's computer, used the stolen credentials from Engineer A to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.

As of Tuesday, Binance said it has rebuilt the compromised wallet system and internal AI tool, and replaced all of the affected devices. It also decommissioned all credentials and tokens assigned to the compromised engineers, and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets.

REG AD

The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures. Binance said it’s also working to establish a security research fund and initiatives with AI companies and security shops to focus on AI security in blockchain environments.®

supply chain attack north korea binance security cryptocurrency 35

Make us preferred on Google

REG AD

## Cyberattack on French plasma stores is enough to make your blood boil Attackers reportedly set cold-room controls to 110°C, but safeguards prevented stock losses

Windows pushed AI PCs, but now it's hit a wall of RAM prices Customers sweating assets amid tight budgets, as Microsoft execs get creative with sales pitches

From expertise to intelligence: NISCO deploys world's first swarm-intelligence steel model at scale PARTNER CONTENT: 300+ AI applications delivering surges in core metrics and annual cost reduction of over CNY100m

Datacenter operators must win hearts and minds, not just permits Schneider sees no slowdown despite backlash, but says communities deserve answers on power, water, and noise

OPINION ## Microsoft's moolah mountain is more massive than ever. It just doesn't want the people who built it Flash the cash, flush the cache

China outlines plans for moonshot it hopes to land by 2030 We have go for launch, and the ethernet and Wi-Fi standards that will make it happen

About Us

Our Websites

The Next Platform
DevClass
Blocks and Files
Situation Publishing

Your Privacy

Cookies Policy
Privacy Policy
Ts & Cs
Do not share my personal information
Your Consent Options

朝鲜虚假求职面试导致 Binance 发生 63 亿美元加密货币盗窃案

North Korean fake job interview led to $6.3B Binance heist

READ MORE

FBI pins $6.3B Binance crypto heist on North Korean hackers 1 day ago

Google says Asian advertisers spending less due to Europe's customs changes 2 days ago

In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security 5 days ago

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour 5 days ago

China's spaceplane bears striking resemblance to America's X-37B 6 days ago

Windows pushed AI PCs, but now it's hit a wall of RAM prices Customers sweating assets amid tight budgets, as Microsoft execs get creative with sales pitches

From expertise to intelligence: NISCO deploys world's first swarm-intelligence steel model at scale PARTNER CONTENT: 300+ AI applications delivering surges in core metrics and annual cost reduction of over CNY100m

Datacenter operators must win hearts and minds, not just permits Schneider sees no slowdown despite backlash, but says communities deserve answers on power, water, and noise

China outlines plans for moonshot it hopes to land by 2030 We have go for launch, and the ethernet and Wi-Fi standards that will make it happen

TOP STORIES

AI

Windows pushed AI PCs, but now it's hit a wall of RAM prices Customers sweating assets amid tight budgets, as Microsoft execs get creative with sales pitches

Drax wants to feed Britain's AI habit with £20B datacenter at biomass power station But first it needs planning permission, government approval and, rather importantly, a customer

Anthropic's compute tab could top $1T as Q3 revenue nears $17B Revised IPO filing warns 12x revenue growth is unlikely to continue

Marvell wants to be a copper topper, bets $115B on photonics leader to push optical networking IP house believes optics demand is going to explode as Nvidia and others eye bigger systems

Infosec

FOSS

Achieving nirvana: Enlightenment 0.28 hits the desktop Very nearly 30something environment gets spruced up… and there's a new Trinity, too

Architect creates open source replacement for VM migration tool VMware has hidden OpenVDDK is reportedly already being used in production, at scale

AlpineBSD announced – an AI-free FOSS OS Combining the NetBSD kernel with the Alpine Linux userland

Ubuntu 27.04 may bring a preview of the long-awaited Core Desktop Canonical has a long way to catch up, but it knows who it's chasing

Systemd adds support for Rust What's even better than Rust in the Linux kernel? Rust in systemd!

FreeBSD founder ports Omarchy to FreeBSD in ten days, ten releases Daemonarchy is unaffiliated with the Linux original, built with AI help, and could complicate FreeBSD's debate over AI contributions

About Us

Our Websites

Your Privacy

Archives