Researchers warned of North Korean tactics before $6.3 billion Binance heist

Binance says North Korean hackers used fake social media profiles and a supposed job offer to trick an employee into downloading malware, part of a months-long scheme that led to the theft of $6.3 billion in cryptocurrency. The company has called it the largest crypto theft in history.

The hackers posed as recruiters and contacted a Binance software engineer who works on wallets. After two interviews, the engineer was asked to download what appeared to be a coding assignment. Binance said the file contained malicious code that compromised the engineer’s work laptop, and its security tools did not detect the malware.

Binance said the attackers then used an internal tool to take over the work computers of two other wallet-team engineers. One had previously downloaded a tampered app containing password-stealing malware. After Binance replaced that engineer’s laptop, the hackers used stolen credentials to access a third engineer’s computer and systems capable of controlling billions of dollars in crypto.

The theft was disclosed in an updated statement on X on Tuesday. Binance suspended customer withdrawals across its network. The FBI and blockchain investigators have blamed North Korea. Binance said it faced at least 57 suspected attacks from North Korea and has put new security measures in place. Researchers have repeatedly warned that North Korean actors use fake recruiter and investor identities to gain access to companies. Binance said it would bring in cybersecurity experts to review the incident. A company spokesperson referred TechCrunch to Binance’s public statement and declined to answer questions on the record.