North Korean hackers used fake job interviews and a Binance internal AI tool to steal $6.3 billion in crypto
Published · updated · curated by AI Is Going Just Great
Source: theverge.com ↗
"The 0-day malware was not detected by the endpoint security protection tools at the time."
The largest crypto theft on record combined two of the oldest tricks in the book: a malicious Google ad and a fake job interview. Binance's postmortem traces the breach to June 2026, when one developer downloaded a tampered installer delivered through a search engine ad, exposing internal engineering details. A second engineer was targeted in September by someone posing as a recruiter who ran multiple interview rounds, built a social media presence to establish trust, and eventually got the engineer to download a fake assignment that was actually malware. Binance's security team caught the first infection and replaced the device; it missed the second, which swapped out a legitimate dev tool for a backdoored version that the endpoint protection never flagged.
By October 20th, the FBI-identified North Korean unit "TraderTraitor" used Binance's own internal AI tool to gain control of wallets belonging to the first compromised engineer and a third employee. On October 29th they logged into that third employee's machine and launched the actual heist. Binance CEO Richard Teng says 98% of impacted tokens have been replenished and no user is bearing the loss, with about $2.85 billion frozen or intercepted. The postmortem is notably silent on what the internal AI tool actually does and why it handed wallet access to the attackers.