Binance confirmed a sophisticated multi-stage cyberattack led by North Korean hackers, resulting in a record-breaking $6.3 billion theft. The incident report reveals that attackers used social engineering through fake job interviews to trick a software engineer into downloading malware. The campaign began in June with a supply chain attack and culminated on October 29 after months of deception.
The FBI attributed the heist to Trader Traitor, a unit of the Lazarus Group, known for combining espionage with massive cryptocurrency thefts. The hackers posed as project directors and CEOs during video interviews on legitimate platforms, building trust before instructing the engineer to download a malicious code repository. Once executed, the malware replaced a legitimate development tool, enabling unauthorized access to internal systems.
Attackers used compromised credentials and an internal AI tool to escalate privileges, ultimately deploying a container that executed the theft. Binance has since rebuilt its wallet infrastructure and rotated all affected credentials. The breach highlights the growing sophistication of state-sponsored cyber operations targeting the crypto industry.
Source: Hacker News · Summarized by HeadlinesBriefing