Binance says North Korean hackers used fake social media profiles and a purported job opportunity to target an employee in a months-long operation that led to the theft of $6.3 billion in cryptocurrency. The exchange disclosed further details in an updated statement posted on X on Tuesday and said it had suspended customer withdrawals across its network after the incident, which it described as the largest crypto theft in history.
According to Binance, the attackers posed as recruiters and contacted a software engineer who works on the company’s wallets. After two interviews, the engineer was asked to download what appeared to be a coding assignment. The file contained malicious code that compromised the employee’s work laptop, and Binance said its security tools did not detect it.
The attackers then used an internal tool to take control of the work computers of two other engineers on the wallet team. One of them had downloaded a tampered app containing password-stealing malware months earlier after finding the software through search results. Although Binance replaced that employee’s laptop, the hackers used stolen credentials to access a third engineer’s computer. That employee could reach systems capable of controlling billions of dollars in cryptocurrency.
Researchers have repeatedly warned that North Korean hackers use patient, long-running social engineering campaigns, posing as recruiters, investors or venture capitalists to gain access to organizations. The tactics have also been the subject of warnings from the U.S. government and cybersecurity companies. Binance said it had faced at least 57 suspected North Korean attacks, which it called evidence of a persistent state-backed threat to the crypto industry.
The FBI and blockchain investigators have blamed North Korea for the heist. The country has been accused of large-scale cryptocurrency thefts in recent years to fund its internationally sanctioned nuclear weapons program.
Binance said the attack “should not have happened” and that it had strengthened network security. The company also said it would bring in cybersecurity experts to review the incident and introduce measures to prevent a repeat. A Binance spokesperson referred questions from TechCrunch to the public statement and declined to comment on the record about how the company prevents malicious code from running on employee laptops or whether outside firms had audited its network before the breach.
Sources: TechCrunch.