North Korea's fake job interview fueled $6.3B Binance hack
Original: North Korean fake job interview led to $6.3B Binance heist
Why This Matters
Largest crypto theft ever shows nation-state actors now combine supply chain, social engineering, and insider access in sustained multi-month operations.
North Korean hackers from TraderTraitor/Lazarus Group tricked Binance engineers via fake job interviews and malware downloads, leading to a $6.3B crypto heist on October 29, 2026, per Binance's incident report.
The $6.3 billion Binance breach — the largest crypto theft on record — wasn't a smash-and-grab. It was a methodical, months-long campaign combining supply chain attacks, social engineering, and internal system compromise, according to Binance's Tuesday incident report.
The groundwork started in June when an engineer ('Engineer A') downloaded a malicious Homebrew package — a supply chain attack. Security caught it, swapped the device, rotated credentials. But the engineer's role on the wallet infrastructure team had already been exposed to the attackers.
Then in September came the social engineering phase. A second engineer was approached on a legitimate job-hunting platform by someone posing as a project director. A series of fake interviews followed, including a live video call with a sham HR rep who shared a social media account during the session — presumably used to deliver malware. From there, the attack chain included endpoint takeover, compromised internal AI tooling, and what Binance described as an 'advanced transaction-authorization method.'
The FBI attributed the attack to TraderTraitor, the North Korean operation tied to Lazarus Group. The crew is well-practiced at both sides of job-market fraud: planting their own operatives as fake IT workers at Western firms, and posing as employers to lure engineers into downloading malware. The October 29 breach was the payoff of at least five months of preparation.