Binance’s $6.3 Billion Heist Exposes How a Fake Interview Became a Crypto Catastrophe
Binance’s $6.3 Billion Heist Exposes How a Fake Interview Became a Crypto Catastrophe
The attack, Binance says, did not begin with a spectacular technical break-in. It began months earlier with trust.
In June, an employee in the exchange’s wallet-infrastructure unit downloaded a tampered version of software while trying to install an AI coding tool. Binance said it detected the anomaly, replaced the device and rotated credentials — but concluded the team had already been exposed.
By September, the operation had shifted to a more personal lure. A person posing as a project director approached a Binance software engineer on a legitimate job platform. Two interviews followed, including a live video call with a supposed HR representative whose social-media profile was stocked with photographs and videos. The final “assignment” was malware, disguised as a work task. Binance called the tactic “more advanced and deceptive than previously seen social engineering approaches.”
On Oct. 20, according to the company’s account, the attackers used the compromised computer and an internal AI tool to seize control of two wallet-team engineers’ machines, including one with software-deployment privileges. Nine days later, they reached a transaction-signing service and began emptying hot wallets — the accounts used for rapid withdrawals.
Binance’s more detailed timeline says the actual outflow was breathtakingly fast: between 20:05 and 20:09 UTC on Oct. 29, five XRP hot wallets sent 233.46 million XRP to an attacker-controlled address, alongside major transfers from Solana and Optimism wallets. “This should not have happened,” the exchange said, apologising for the disruption and uncertainty.
The FBI said on Oct. 31 that TraderTraitor, a North Korean hacking unit, carried out the theft. Binance says it has blocked 57 other suspected North Korea-linked attempts this year, framing the incident as part of a sustained campaign against crypto platforms. North Korea, however, rejects Washington’s attribution. Kim Yo Jong called it “absurd rhetoric” and accused the United States of branding the country a cybercriminal state to mislead international opinion.
Binance says it has rebuilt affected systems, replaced compromised devices and will bring in outside security reviewers. But the episode’s central lesson is harsher: in crypto, a convincing job interview can be as dangerous as a zero-day exploit.
Write a comment