North Korean hackers infiltrated Binance with fake interviews and stole $6.34B in crypto

Binance Holdings Ltd. says a North Korean group spent about five months building access through fake hiring processes, infected developer machines, and abused internal tooling before draining crypto assets worth $6.34 billion. For high-risk PSPs and exchanges, the useful part is not the headline number; it is the route in: employee targeting, signing-key exposure, and abuse of internal approval logic.

1. According to Binance Holdings Ltd.’s initial investigation report released on the 3rd, the attack started in June and targeted several employees over about five months. The first step was social engineering: the hackers lured Engineer A, who develops and operates cryptocurrency wallets, into downloading a tampered development tool.
2. Binance’s security team detected anomalies, replaced the device, and changed authentication credentials, but the response itself exposed personal information of wallet infrastructure team staff to the attackers. In September, the same group approached Engineer B on a job-seeking platform and ran a fake hiring process.
3. In the first video interview, a person posing as an interviewer shared a social media account containing personal photos. In the second interview, a person impersonating the CEO demanded a task, which led B to install malware on a work computer. That malware exploited a vulnerability not detected by the security tool at the time and turned a legitimate development tool into malicious software.
4. On the 20th of last month, the attackers abused an in-house AI tool through B’s infected computer, then sequentially gained control over Engineers A and C and obtained the program distribution signing key held by A. On the 29th of last month, they logged into C’s computer and distributed malicious software using A’s signing key.
5. From 8:05 p.m. to 8:09 p.m. Coordinated Universal Time (UTC), the hackers illicitly withdrew 233,460,000 XRP, then transferred 970,500 SOL, 44,200,000 OP, 18,270 bitcoin, and 2,961.9 ether. On the Ethereum network, they abused the approval authority of EIP-7702 and used 50 preprepared pre-signatures to delegate asset withdrawals, bypassing normal withdrawal procedures.

Binance said the affected cryptoassets total $6.34 billion, of which $2.85 billion was frozen or blocked through cooperation between exchanges and issuers. The company said it covered more than 98% of the losses with its own funds, the Secure Asset Fund for Users (SAFU), and a futures insurance fund, and that it reset the related delegation code at 9:10 a.m. Korea Standard Time on the 30th, about four hours after the attack began, to stop further leakage.