Binance says North Korean hackers used a fake job interview to persuade an employee to install previously unseen malware, then leveraged the compromised device and internal systems to breach the exchange’s wallet infrastructure and steal approximately $6.34 billion in digital assets. The cryptocurrency exchange’s incident report describes a campaign involving social engineering, malicious software and stolen credentials that culminated in the October 29 cryptocurrency theft.
The FBI has attributed the attack to the North Korean state-sponsored hacking group TraderTraitor, which is also tracked as Lazarus Group, Jade Sleet and APT38.
Fake recruiters targeted a Binance engineer
According to Binance, the attack began in September when someone posing as a project director at a fictitious company contacted software engineers through a legitimate job-search platform. The targeted employee’s profile mentioned experience at Binance, making the person an attractive target for attackers seeking access to a cryptocurrency exchange.
The fake recruiter arranged two interviews. The first was with someone claiming to represent human resources, while the second involved a person posing as the company’s chief executive.
During the initial interview, the fake HR representative held a live video call and shared social media accounts containing personal photos and videos to build trust. The second interview took place through a popular social chat application, where the employee was instructed to download a coding assignment from an online code repository.
Binance said the repository contained malicious code that compromised the employee’s device with custom malware that antivirus software could not detect at the time.
“The malware employed sophisticated obfuscation and evasion techniques, including replacing legitimate development tools components with malicious versions, in order to execute commands and establish communication with external servers controlled by the attackers,” Binance explained.
“Zero-day malware was not detected by endpoint security protection tools at the time. Attackers took steps to hide their malicious activity and remove any evidence of compromise, making detection and subsequent investigation more difficult.”
Malware replaced a macOS development tool
Binance said the malicious script created an alternate executable named pyenv_ in the macOS Homebrew installation directory. It then deleted the legitimate pyenv executable, renamed the malicious file to pyenv, changed the symbolic link and used it to start a Z shell (zsh) process.
This substitution allowed the attackers to execute commands received from a server they controlled.
By October 20, the attackers had used the compromised engineer’s computer and Binance’s internal AI tools to compromise two additional employees involved in the exchange’s wallet infrastructure. They obtained the employees’ credentials and container deployment tokens.
On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance’s wallet-signing service. This enabled them to transfer billions of dollars in cryptocurrency across multiple blockchains.
The attackers also exploited Ethereum’s EIP-7702 authentication mechanism, allowing them to continue stealing cryptocurrency after Binance halted withdrawals.
Binance freezes stolen assets and rebuilds systems
Binance said it has rebuilt the affected systems, replaced compromised devices and revoked the stolen credentials. As of November 3, approximately $2.85 billion in stolen assets had been frozen or intercepted. As of October 31, 98% of the affected token assets had been replenished.
The exchange said it is continuing to investigate the breach and has engaged an independent security firm to review the findings.
Fake interviews remain a North Korean hacking tactic
Fake job interviews that result in malware installation are a common feature of North Korean hacking campaigns known as “Contagious Interview” and “Operation Dream Job.” These operations use fake employment opportunities and interviews to target developers and cryptocurrency employees.
In June 2025, cybersecurity firm Socket reported that the Contagious Interview campaign impersonated LinkedIn recruiters and sent developers coding assignments containing malicious npm packages.
The attackers distributed 35 malicious npm packages that installed malware capable of stealing browser credentials, cryptocurrency wallet data and other information from infected computers.
North Korean Lazarus hackers have used similar methods in Operation Dream Job, distributing malware disguised as employment documents to people working in software development and decentralized finance, or DeFi, companies.
Binance has not linked the employee compromise to a specific campaign. However, the use of fake recruiters, multiple interviews and malicious coding assignments closely resembles previously documented North Korean tactics.
Source: www.bleepingcomputer.com