Binance details how a fake job interview enabled a $6.34 billion crypto theft
Binance says North Korean hackers used a staged job interview to infect a software engineer's device with previously unseen malware, then leveraged that access to compromise the exchange's wallet infrastructure and steal roughly $6.34 billion in digital assets on October 29. The FBI has attributed the attack to the state-sponsored TraderTraitor group, also tracked as Lazarus Group.
BleepingComputer
Cryptocurrency exchange Binance has published an incident report explaining how North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately enabled the theft of about $6.34 billion in digital assets on October 29. The report describes a chain of social engineering, malicious software, and compromised internal systems that culminated in one of the largest crypto thefts on record.
The FBI has attributed the attack to North Korean state-sponsored hackers tracked as TraderTraitor, a group also known as Lazarus Group, Jade Sleet, and APT38.
According to Binance, the operation began in September when a software engineer was contacted through a legitimate job-hunting platform by someone posing as a Project Director at a fictitious company. The employee's profile referenced his experience at Binance, making him a valuable target for attackers seeking access to the exchange.
The fake recruiter scheduled two interviews. In the first, an impostor posing as a human resources representative held a live video call and shared a social media account containing personal photos and videos to build trust. The second interview took place through a popular social chat application, where the employee was instructed to download a coding assignment from an online code repository.
Binance says the repository contained malicious code that infected the employee's device with previously unseen custom malware that antivirus software did not detect. The company stated that the malware used sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and communicate with an attacker-controlled external server. Binance added that the zero-day malware went undetected by endpoint security tools at the time, and that the attackers concealed their activity and removed traces of the compromise, making detection and investigation more difficult.
The malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory. It then deleted the legitimate pyenv executable, renamed the malicious file to pyenv, modified its symbolic link, and used it to spawn a Z shell process, giving the attackers a channel to run commands received from their server.
By October 20, the attackers had used the compromised engineer's computer and an internal AI tool to compromise two additional employees working on Binance's wallet infrastructure, obtaining credentials and a container deployment token. On October 29, they used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance's wallet signing service, transferring billions of dollars in cryptocurrency across multiple blockchains. The attackers also abused Ethereum's EIP-7702 authorization mechanism, which allowed them to keep stealing cryptocurrency even after the exchange suspended withdrawals.
Binance says it has since rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted, and 98 percent of impacted token assets had been replenished as of October 31. The company says its investigation is ongoing and that independent security firms have been brought in to review its findings.
Fake job interviews that lead to malware installs are a hallmark of North Korean hacking campaigns known as Contagious Interview and Operation Dream Job. In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages, ultimately distributing 35 such packages that stole browser credentials, cryptocurrency wallet data, and other information. Lazarus hackers have also used Operation Dream Job to distribute malware disguised as employment documents to people at software development and DeFi companies. While Binance has not linked the employee compromise to either specific campaign, its use of a fake recruiter, multiple interviews, and a malicious coding assignment closely mirrors these previously documented tactics.