Binance: North Korean hackers planned $6.3B heist for months
Original: Binance says hackers who stole billions in crypto spent months planning heist
Why This Matters
A $6.34B state-linked theft sets a new bar for exchange security risk.
Binance confirmed North Korean-linked hackers stole $6.34B in crypto after a months-long campaign using fake job interviews, tampered software, and novel malware. The exchange has since frozen $2.85B of the stolen funds.
The largest cryptocurrency theft on record was not a smash-and-grab. Binance revealed Tuesday that the attackers — attributed to North Korea by the FBI and TRM Security — began laying groundwork no later than June before successfully breaching an engineer's laptop last Thursday and draining multiple wallets.
The campaign combined several attack vectors. In June, one engineer downloaded a tampered version of Homebrew, the macOS package manager. Binance's security team caught the compromised device but not before the malware operators had mapped out the engineer's role in the wallet infrastructure team.
In September, a second engineer was targeted via a legitimate job-hunting platform. A fake recruiter posing as a project director arranged two-stage interviews — the first over video, the second via a chat app. During the second session, the engineer was instructed to download an "assignment" from a code repository. The payload replaced a legitimate development tool with a malicious version, opened a backdoor to an attacker-controlled server, and evaded endpoint detection entirely.
"The attackers combined social engineering, malicious software downloads, compromised internal AI tooling, and an advanced transaction-authorisation method," Binance said in its investigation report. The $6.34B targeted exceeds any previous crypto theft on record. Binance says it has reserved funds to cover the net loss of roughly $3.49B and published a Proof of Reserves page.