Binance reveals hackers used fake job interviews, malicious code in $6.3bn heist

Binance reveals hackers used fake job interviews, malicious code in $6.3bn heist

Binance released on Tuesday a detailed investigation into the $6.3 billion hack of its cryptocurrency platform, showing how attackers used fake job interviews and malicious code to steal the funds. The crypto exchange said it had replenished 98 per cent of the affected assets by drawing on its own funds, with the remaining amount involving little-traded currencies that are harder to acquire. The attack, carried out over about four hours on Oct 29, was attributed by the US Federal Bureau of Investigation (FBI) to North Korea-affiliated hackers. Pyongyang has denied the allegations, with the powerful sister of leader Kim Jong Un calling the claim “absurd rhetoric”. Around $2.85bn of the stolen $6.34bn has been frozen, Binance said, meaning that the attackers could not use it or convert it to another currency. Binance is the world’s largest crypto exchange by daily trading volumes. News of the hacking attack, which is thought to be the biggest ever crypto heist, caused the prices of most major cryptocurrencies to fall sharply. According to Binance, attackers took their first steps towards the breach as early as June. First, they targeted a platform engineer by getting them to download a virus-laden version of the widely-known programming software Homebrew. Binance’s cybersecurity teams identified the malware and removed it, but the hackers had already had time to harvest information about the engineer and his colleagues. In September, the attackers approached another Binance engineer through a legitimate job-search platform, offering him an interview for a position in a fictitious company. After building trust with the subject through the sharing of social media photos and videos, they asked the engineer to download a test exercise as part of the interview process. The exercise contained malware that deployed “sophisticated obfuscation and evasion techniques,” Binance said, including replacing a legitimate development tool component with a malicious version. That malware was critical to the success of the attack, as it allowed the hackers to establish a connection with Binance’s internal systems. On October 20, the attackers used the access they had gained and an internal AI tool to gain control over software used by two other engineers. Nine days later, they triggered malicious code that initiated the attack. Binance says outflows normalised as North Korea rejects US allegation Asset outflows from Binance have normalised and the company was in “very strong financial health”, its co-CEO said. The world’s biggest cryptocurrency exchange, whose customers had withdrawn a net $4.72bn as of Monday after the financial heist, has also launched a campaign to stem outflows and woo new users. “In the first 24 hours, there was a spike in terms of withdrawals, as can be expected. But after that … it’s pretty much normalised,” Richard Teng told a Hong Kong Fintech Week event on Tuesday. “The company is in very strong financial health,” he said. “This is something that we can cover. We are able to do so.” The crypto exchange was seeing “hourly deposits exceed withdrawals”, Binance said in an X post earlier on Tuesday, adding that it reflected improving user activity and stabilising flows. The Federal Bureau of Investigation (FBI) said on the weekend that North Korea was responsible for the theft of more than $6bn in crypto assets, a crime that sent shockwaves through the industry. Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, said the US allegations proved Washington remained hostile towards Pyongyang, according to a report on Tuesday by state news agency KCNA. Pyongyang has not responded to US President Donald Trump’s overtures, made earlier this year, to resume summit diplomacy. In the wake of the US allegations, Kim Yo Jong said North Korea had “issues to reconsider” over what she called US hostility. “The FBI is trying to brand the DPRK as a ‘cyber criminal state’, claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” KCNA quoted Kim Yo Jong as saying. “But the US assertion is absurd rhetoric and nothing new,” said Kim, a ruling party official. DPRK is short for the Democratic People’s Republic of Korea. “It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cyber crimes in different parts of the world are our deeds.” Revenue stream North Korea faces growing scrutiny over cryptocurrency theft, which analysts say is a key source of funds for its weapons programmes. Cybersecurity experts say North Korean hackers are among the world’s most prolific crypto thieves and the proceeds help fund the country’s efforts to develop nuclear weapons and ballistic missiles capable of hitting the United States. North Korea has stolen cryptocurrency worth $7.6bn this year, more than in any previous year, according to estimates by blockchain analytics firm Elliptic. North Korea denies allegations linking it to cryptocurrency theft and other cybercrimes. Analysts in Seoul said Pyongyang’s unusually swift response likely reflected concern that the allegation could lead to tighter efforts to disrupt revenue streams that North Korea is accused of using to finance its weapons. “With sanctions already in place, cryptocurrency theft has become one of North Korea’s key channels for securing funds for regime maintenance and weapons development,” said Lim Eul-chul, a professor at Kyungnam University’s Institute for Far Eastern Studies. Additional US measures targeting crypto wallets, laundering networks and cryptocurrency exchanges could choke off an important source of revenue, Lim said. South Korea’s central bank estimated North Korea’s gross domestic product at 47.18 trillion won ($35.09bn) in 2025, meaning the Binance theft could be equivalent to about a sixth of its economic output. Blockchain analytics firm Chainalysis estimated 89pc of crypto hack losses in 2026 were linked to North Korea, up from 15pc in 2021. It said the average reported loss per hack rose from $50.65 million in 2021 to $185.65m in 2026. “I guess you could call it big game hunting, where they’re targeting these larger exchanges that may take more time and more complexity to be able to do … but the payoff can be relatively large,” said Alec Zebrick, senior manager of Asia-Pacific Global Services at Chainalysis. Infographic depicting amount lost every month due to crypto hacks. — Courtesy Reuters North Korea is one of the world’s most impoverished countries but has poured resources secured through illicit means and activities banned under UN Security Council resolutions into its missile and nuclear programmes. Kim Yo Jong said North Korea would “reconsider” unspecified issues in light of the “very unpleasant US hostile attitude”, without elaborating. North Korea has not publicly responded to Trump’s offers to resume summit diplomacy. Binance withdrawals Binance launched a campaign on Monday offering fee rebates, rewards to eligible users who rack up at least $10,000 in cumulative trading volume, as well as annual percentage rates of up to 10pc on certain yield-generating products. The exchange’s “community appreciation campaign” will run through Nov 21, a post on its website showed. Binance, which froze withdrawals for more than two days after the hack and then started allowing customers to withdraw again on Sunday morning in some assets, reopened withdrawals for more assets on Tuesday. Since the resumption of withdrawals, Binance has seen net outflows amounting to around 3pc of the assets on its platform, it said on Monday, a relatively modest figure that analysts said suggested customer confidence had largely held up. “The relatively contained price reaction suggests a degree of maturity and resilience,” said Maksym Repa, head of DeFi at Lombard, a Bitcoin finance protocol backed by Franklin Templeton. “Investors appear to be distinguishing between a security failure at a centralised exchange and a problem with the Bitcoin network itself.”