Fake North Korean job interview led to $6.3 billion theft at Binance

Binance published an incident report this Tuesday (3rd) detailing how a months-long campaign, attributed to North Korean hackers, culminated in the theft of $6.3 billion in cryptocurrencies on October 29th. According to the exchange, the attack was not an isolated incident or simple phishing, but a multi-stage operation that combined social engineering via a fake job posting, malware, compromise of internal AI tools, and an advanced method for bypassing transaction authorization.

On the weekend before the report's publication, the FBI attributed the theft to TraderTraitor, a North Korean hacking group linked to the Lazarus Group, known for combining espionage with multimillion-dollar heists against crypto exchanges. The collective, sponsored by Pyongyang, also specializes in job-market fraud: sometimes posing as IT workers hired by Western companies, other times posing as recruiters to induce developers into downloading malware onto corporate machines. In this case, they used the second approach.

The entry point came in June

According to Binance, preparation for the attack began as early as June, with a supply-chain attack: an engineer on the wallet infrastructure team downloaded a malicious Homebrew installation. The security team detected the malware at the time, replaced the device, and revoked the affected credentials. But the damage was already done: the role of this engineer, referred to as "Engineer A" in the report, and of his colleagues on the wallet team, was exposed to the attackers.

Three months later, in September, the actual social engineering phase began. Another Binance software engineer was contacted through a "legitimate job search platform" by someone presenting themselves as the project director of a fictitious company, who arranged a series of interviews.

How the fake interview gained credibility

The first step was a live video call with the engineer and a supposed HR representative. To build trust, the interlocutor shared a social media account with personal photos and videos, according to Binance's report. The exchange described this tactic as "more advanced and deceptive than previously seen social engineering approaches".

The second interview, conducted through a popular chat app, was led by someone posing as the fake company's CEO. At the end of the conversation, the supposed CEO instructed the engineer to download a "task" containing a code repository with embedded malware. The code was executed on the engineer's work machine during the setup process, kicking off a series of unauthorized activities.

The malware that swapped a legitimate tool

According to Binance, the malware replaced a legitimate component of a development tool with a malicious version, which executed commands and established communication with an external server controlled by the attackers. The attackers also took steps to hide the malicious script and avoid detection, which worked: Binance's endpoint security tools did not identify the malware immediately. The report published the script used in the attack:

CREATE /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_
MODIFY pyenv_ → 3.414 B
DELETE .../libexec/pyenv (3.344 B) ← removes the valid pyenv
RENAME pyenv_ → pyenv (3.414 B) ← replaces with the malicious version
DELETE /opt/homebrew/bin/pyenv (3.414 B)
ln (creates a new symlink) + spawn zsh

The script manipulates pyenv, a Python version manager widely used by developers, swapping the legitimate binary for a malicious copy and creating a new symlink that spawns a zsh shell.

From a compromised computer to the $6.3 billion theft

On October 20th, the attackers used the already compromised computer and an internal Binance AI tool to gain access to two other engineers' machines: "Engineer A," from the wallet DevOps team, and "Engineer C," a software developer also linked to wallets. Engineer A had a container deployment permission token on his computer, which the attackers soon discovered.

On October 29th, the group accessed Engineer C's computer, used Engineer A's stolen credentials to deploy a container, and triggered a script that carried out the cryptocurrency theft. This is the event that the FBI, two days before the publication of Binance's report, had already attributed to TraderTraitor.

What Binance did after the attack

The exchange reported that it has already rebuilt the compromised wallet system and the internal AI tool, in addition to replacing all affected devices. It also revoked all credentials and tokens assigned to the compromised engineers and says it is working with law enforcement, blockchain intelligence firms, and security researchers to trace and freeze the stolen assets.

Binance hired independent cybersecurity experts to conduct a full review of the incident and recommend additional protective measures. The exchange also stated it will create a security research fund and initiatives with AI companies and security firms specifically focused on AI security in blockchain environments.

What this means for hirers and job seekers

The case reinforces an already known pattern among operations like TraderTraitor/Lazarus: using the hiring process itself as an attack vector, whether by applying for jobs or by offering them. For engineering teams in Brazil that receive "technical tests" or evaluation repositories during hiring processes, the practical lesson is to isolate that execution: run it in a disposable virtual machine, sandbox, or container without access to production credentials, never on the work machine with real tokens and keys.

For companies that handle digital assets, Binance's report also exposes a structural issue: the compromise of a single developer, months before the final attack, was enough to map the entire wallet infrastructure team. Permission segmentation, aggressive token rotation, and monitoring of internal AI tools (which, in this case, were used by the attackers themselves to pivot between machines) stand out as points the investigation is still detailing.