Binance says attackers used a fake recruitment process to compromise an employee’s work computer in a multi-stage campaign that culminated in the theft of $6.3 billion in cryptocurrency on October 29. The exchange’s incident report described a sequence involving social engineering, malware, internal tooling and stolen deployment permissions rather than a single phishing message.
The Register reported that the FBI attributed the theft to TraderTraitor, a North Korean operation linked to the Lazarus Group. North Korean operators have previously used both fraudulent IT-worker identities and fake employer approaches to enter company networks. The attribution and the precise loss remain claims reported from the investigation and law-enforcement assessment.
According to Binance, preparation began in June when an engineer downloaded a malicious Homebrew installation. Security staff detected that malware, replaced the device and rotated affected credentials. The company said the episode nevertheless exposed information about the engineer’s role and colleagues working on wallet infrastructure.
In September, a different Binance software engineer was contacted through a legitimate job platform by someone posing as a project director. A staged video interview and social-media profile were used to build trust. During a later interview, a person claiming to be the fake company’s chief executive instructed the engineer to download a coding assignment. The repository contained malware that ran during setup on the employee’s work-issued computer.
The malicious code replaced a legitimate development-tool component, contacted an attacker-controlled server and attempted to conceal itself. Binance said its endpoint tools did not immediately detect the compromise. On October 20, the attackers allegedly used the infected device and a compromised internal AI tool to reach computers belonging to two members of the wallet team. One held a container deployment token.
The exchange said the attackers later accessed another developer’s machine, used the stolen token to deploy a container and triggered the script that initiated the theft on October 29. That progression shows why conventional credential rotation after the first incident was insufficient: the attackers had accumulated organizational knowledge and established a new foothold through a separate employee.
Binance said it rebuilt the affected wallet system and internal AI tool, replaced compromised devices, and revoked credentials and tokens associated with the engineers. It is working with law enforcement, blockchain intelligence companies and security researchers to trace and freeze assets, and has hired independent experts to review the incident.
The case underscores the risk of running unfamiliar code during recruitment exercises, particularly on corporate devices. It also shows how attackers can combine patient social engineering with access to legitimate development infrastructure. The strongest defensive response requires controls at several layers, including isolated environments for candidate code, tighter deployment-token handling, behavioral monitoring and verification of external interview processes.
