North Korean hackers used fake job interviews to steal about $6.34bn from Binance
CRITICAL · BREACHBinanceredteam/daily · 3 sources
- Severity
- Critical
- Sources
- 3
What happened
Binance says a multi-stage campaign, which the FBI attributes to the North Korea-linked TraderTraitor group, affected about $6.34 billion in digital assets on 29 October. The attack began with a tampered Homebrew package in June and a fake recruiter's malicious coding assignment in September, which evaded endpoint tools. The attackers then abused an internal AI tool and a container deployment token to reach the wallet signing service and used an EIP-7702 delegation to keep control of a hot wallet.
For IT people · Written by AI from 3 sources · Wrong?
What to do
- Treat job offers that ask you to run code or download an assignment onto a work computer as a threat.
- Use separate devices for job interviews and keep deployment tokens off laptops.
- Limit what internal AI tools can reach and track changes to account permissions, not just transfers.
- During an incident, revoke access and rotate keys as separate steps.
Written by AI from the sources, checked against them
Full story timeline · 3 updates
- Tue 3 NovemberNorth Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance HeistCyber Security News
- Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion HeistWired (Security)
- Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion AttackSecurity Affairs
Who reported · 3 outlets
Cyber Security NewsWired (Security)Security Affairs
Who and what is in it
Threat actors