Technology
Binance says a $6.3 billion crypto heist began with malware and fake job interviews
Binance says attackers used malware, fraudulent recruitment interviews and an internal AI tool to compromise engineers before draining $6.34 billion from the exchange’s hot wallets. The intrusion began with an accidental malware download, expanded through a fake job process targeting a wallet developer, and culminated in a malicious script using stolen credentials. Binance says $2.85 billion was frozen or intercepted. The FBI attributed the attack to North Korea, while Pyongyang rejected the allegation.
Editorial summary · Publisher article
What matters
- A fake project director and sham interviewers persuaded an engineer to download malware.
- The attacker used compromised systems and an internal AI tool to access wallet developers’ machines.
- Binance says nearly $2.85 billion of the drained assets was frozen or intercepted.
- North Korea denied the FBI’s attribution.
The attack combined social engineering with credential abuse
The reported sequence moved from an initial accidental infection to a targeted recruitment scam, then to lateral access across wallet infrastructure. The attacker used credentials stolen from one developer to trigger the final malicious script from another developer’s computer, illustrating how personnel access and technical controls were combined.
Context & caveats
- North Korea’s responsibility remains disputed in the supplied account; the FBI made the attribution and Pyongyang rejected it.
Why this made the edition
Detailed reporting traces the attack from initial compromise through the wallet theft, identifies the social-engineering mechanism, gives recovery figures and preserves the dispute over attribution.
Source material