The $6.3 billion hack of Binance has been traced to an engineer falling for a fake job interview, a signature tactic of North Korea’s state-sponsored hackers, which the FBI has blamed for the crypto heist, the largest on record.
The engineer was duped into installing malware on a work laptop, the cryptocurrency exchange said in a Tuesday update on its investigation. The finding isn’t a surprise, considering North Korean hackers have been known to use the promise of lucrative jobs to spread malware to people in the cryptocurrency industry.
The North Koreans likely learned about individual Binance engineers in June, when a separate employee, dubbed Engineer A, accidentally downloaded a tampered version of the package manager app Homebrew that had been served via a malicious ad. Although Binance detected the malicious Homebrew installation and moved swiftly to shut down the threat, the exchange found that Engineer A’s role “and his related colleagues on our wallet infrastructure team” had been exposed to the hacker, giving hackers a way to breach the exchange.
It looks like the North Korean hackers exploited the intel to target a different engineer in September. “Software Engineer B” was contacted through a legitimate job-hunting platform by a hacker impersonating a project director, Binance said.
“The purported Project Director arranged a first-round interview with an HR representative, followed by a second-round interview with an individual claiming to be the CEO of a fictitious company,” the investigation noted. It’s unclear if AI deepfakes were used, but Binance noted: “The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust. This was more advanced and deceptive than previously seen social engineering approaches.”
In another interview, the engineer was instructed to download an “assignment,” possibly a computer coding test. However, the assignment secretly contained malicious software and was downloaded onto a Binance work laptop. The malware was hard to detect and could replace a legitimate development tool with a malicious version “to execute commands and establish communication with an attacker-controlled external server.”
The compromised work laptop gave the suspected North Korean hackers a way to use Binance’s internal AI tool to access and steal credentials from the original Engineer A, culminating in the hijacking of an internal wallet-signing service to steal cryptocurrency.
Recommended by Our Editors
Binance noted it was well aware of North Korea’s hacking tactics. But still, the exchange’s co-CEO Yi He tweeted: “We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.” Binance’s other co-CEO, Richard Teng, added: “This wasn’t one mistake or one breach—it was a months-long campaign.”
The company and the rest of the crypto industry were able to freeze and recover $2.8 billion in stolen funds. But there’s concern the remaining cryptocurrency could be laundered and used to fund North Korea’s weapons programs. The incident also underscores the continued threat of phishing and how job offers that appear to be too good to be true can lead to malware.
About Our Expert
Michael Kan
Principal Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. In 2024 and 2025, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how the AI-driven memory shortage is impacting the entire consumer electronics market. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Leave a Reply