Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

Crypto giant Binance says North Korean hackers used fake social media profiles and the lure of a potential job offer as part of a months-long scheme aimed at tricking an employee into downloading malicious software onto their laptop.

Researchers have repeatedly warned about long-running social engineering attacks that can go on for months.

This latest attack allowed the hackers to patiently worm their way into Binance’s systems to steal a record $6.3 billion in crypto last week, the company has now confirmed. The hack, disclosed in an updated statement posted on X on Tuesday, prompted the world’s largest crypto exchange to suspend customer withdrawals across its network.

The FBI and blockchain investigators have blamed North Korea for the heist. The country has been long accused of carrying out massive cryptocurrency thefts in recent years to fund its internationally sanctioned nuclear weapons program.

In its latest statement, Binance said that North Korean hackers, posing as recruiters hiring for a job, contacted a software engineer who works on wallets at the company. Following two interviews with the purported company, the engineer was instructed to download an apparent coding assignment as part of the interview process. When opened, the assignment contained malicious code that compromised the engineer’s work-issued laptop. Binance said its security tools did not detect the malware.

That foothold in Binance’s network allowed the hackers to access an internal tool capable of taking over the work computers of two other engineers on the wallet team. One of those engineers had unwittingly downloaded a tampered app containing password-stealing malware months earlier after searching for the software in search engine results. While Binance replaced that compromised engineer’s laptop, the hackers used the engineer’s stolen credentials to break into the computer of a third engineer, whose job allowed them access to systems capable of controlling billions of dollars in crypto.

Binance said the attack “should not have happened,” and that it had improved its network security following the theft.

The hack underscores an ongoing tactic in the North Korean regime’s repertoire of attacks targeting the crypto industry and high-net worth individuals. Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using dossiers of stolen American identities to trick employees into granting access to their systems.

These attacks are widely known across the crypto industry and have been the subject of repeated warnings from the U.S. government and cybersecurity giants in recent years. Some half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters.