North Korea · FBI · The Register
North Korean fake job interview led to $6.3 billion Binance heist
Compiled by KHAO Editorial — aggregated from 3 sources. See llms.txt for citation guidance.
✓ KHAO Verified
'It was not a single isolated breach or a simple phishing incident,' exchange says.
Key facts
- North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week's record-breaking
- RENAME pyenv_ → pyenv (3,414 B) ← replace it with a malicious version
- In an incident report published on Tuesday, the cryptocurrency exchange said several techniques
- including social engineering via fake job interviews, malware downloads, compromised internal AI
- Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists
Summary
North Korean cryptocurrency thieves tricked a Binance software engineer into downloading malware onto their work-issued computer during a fake job interview process before last week's record-breaking $6.3 billion heist. In an incident report published on Tuesday, the cryptocurrency exchange said several techniques - including social engineering via fake job interviews, malware downloads, compromised internal AI tooling, endpoint takeover, and an “advanced transaction-authorization method” - led to the October 29 security breach. “Our current investigation indicates that this was a sophisticated, multi-stage campaign,” the incident report said. Over the weekend, the FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists.