Andrew Lonero

🚨 NORTH KOREAN HACKERS USED FAKE JOB INTERVIEWS TO INFILTRATE BINANCE BEFORE $6.34 BILLION HEIST Binance has revealed how North Korean hackers allegedly spent months infiltrating its internal systems through an elaborate social engineering campaign targeting employees. In September, hackers posing as recruiters contacted a Binance software engineer through a legitimate job platform. The engineer completed a video interview with a fake HR representative, who shared social media profiles containing personal photos and videos to establish credibility. A second interview followed with someone pretending to be the CEO of a fictitious company. Near the end of the interview, the engineer was instructed to download a coding assignment onto his work computer. The assignment contained sophisticated malware that bypassed Binance’s endpoint security protections, giving the attackers access to his machine. On October 20, the hackers used the compromised computer and an internal Binance AI tool to gain access to two additional engineers working on wallet infrastructure. They discovered a container deployment token on one engineer’s computer. On October 29, the attackers accessed another engineer’s computer, used the stolen credentials to deploy a malicious container, and compromised Binance’s wallet signing infrastructure. That access allowed them to authorize fraudulent transactions across multiple blockchains and ultimately steal $6.34 billion in digital assets. Binance says $2.85 billion has since been frozen or intercepted, while 98% of impacted token assets have been replenished. The FBI attributes the attack to North Korea’s TraderTraitor hacking group.