North Korean hackers used fake job interviews to steal about $6.34bn from Binance
- Severity
- Critical
- Sources
- 3
What happened
Binance attributes the loss (29 October 2026, about $6.34bn) to a multi-stage campaign the FBI links to TraderTraitor, also tracked as Lazarus Group and APT38. Initial access came via a fake recruiter, a malicious repository whose setup script swapped a pyenv component and evaded endpoint tooling, then lateral movement through an internal AI tool and a container deployment token. Malicious EIP-7702 delegation on a hot wallet survived withdrawal suspension and was cleared by authorising the zero address, which does not replace the signing key. No CVE is identified. Defenders should restrict internal AI tool reach, keep deployment tokens off endpoints, alert on permission and delegation changes, and revoke access and rotate keys as separate steps.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Treat job offers that ask you to run code or download an assignment onto a work computer as a threat.
- Use separate devices for job interviews and keep deployment tokens off laptops.
- Limit what internal AI tools can reach and track changes to account permissions, not just transfers.
- During an incident, revoke access and rotate keys as separate steps.
Written by AI from the sources, checked against them
Full story timeline · 3 updates
- Tue 3 NovemberNorth Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance HeistCyber Security News
- Binance Says Hackers Used Well-Known Tricks to Carry Out a $6.34 Billion HeistWired (Security)
- Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion AttackSecurity Affairs
Who reported · 3 outlets
Who and what is in it
Threat actors