North Korean hackers used fake recruiters to pull off $6.3B Binance heist

Binance said the attack began with hackers posing as recruiters who contacted a software engineer working on the exchange’s wallet systems. After two interviews, the engineer was told to download what appeared to be a coding assignment — which instead carried malicious code that compromised the engineer’s work laptop without being caught by Binance’s security tools. That foothold let the hackers reach an internal tool capable of taking over the computers of two more wallet-team engineers; one of them had already, months earlier, downloaded a tampered app containing password-stealing malware found through a search-engine result. Although Binance replaced that engineer’s laptop, the hackers used the stolen credentials to break into a third engineer’s machine — one with access to systems controlling billions of dollars in crypto — and from there pulled off the theft, which prompted Binance to suspend customer withdrawals network-wide. The FBI and blockchain investigators have blamed North Korea, which has long been accused of running large-scale crypto thefts to help fund its sanctioned nuclear weapons program.

Researchers have warned for years that North Korean operatives pose as venture capitalists, investors, and recruiters, using dossiers built from stolen American identities to win employees’ trust and access. By Binance’s own count, the exchange had already faced at least 57 suspected North Korea-linked attacks before this one, which it said reflects the “persistent threat posed by state-sponsored actors targeting the cryptocurrency industry.” Security researchers and the US government have separately said North Koreans posing as remote IT workers and recruiters were behind roughly half of all intrusions at US tech companies last year.

Binance called the breach something that “should not have happened” and said it has tightened network security since. Spokesperson Ross O’Leary pointed TechCrunch back to the company’s public statement and declined to answer questions on the record about how Binance restricts unauthorized software on employee laptops or whether outside firms had audited its network security before the hack.

Why it matters

The breach shows a sophisticated, patient social-engineering campaign succeeding against a major exchange despite years of public warnings, and underscores that responsibility for blocking unauthorized code ultimately sits with the company, not just its employees.