North Korean Hackers Plant Malware at Binance Through Fake Job Interviews

Posing as CEO and Interviewers to Lure Staff

Attack Prepared Meticulously Over Five Months

North Korean hackers stole digital assets after luring Binance employees into fake job interviews, according to the world’s largest cryptocurrency exchange.

Binance on Nov. 3 released a preliminary investigation report detailing the attack. The exchange said the hacking campaign appears to have begun in June, when a Binance engineer identified as A downloaded a tampered coding installer. Binance replaced A’s computer, but information about the employee’s role and colleagues was exposed to the hackers.

The group also carried out a fake recruitment process for another Binance engineer, identified as B, through a job platform in September, Binance said. During the first video interview, the interviewer showed B personal social-media accounts to create a sense of familiarity. In the second round, a person posing as the chief executive officer deceived B into downloading malware-laced software onto a work computer by presenting it as an assignment.

Using the information they obtained, the hackers logged into a third engineer C’s computer on Oct. 29. They then used A’s credentials to run malicious software and steal digital assets on a large scale. The attackers took 233.46 million XRP, 970,500 Solana and 44.2 million Optimism tokens from Binance’s hot wallet, an internet-connected wallet. They also stole 18,270 Bitcoin and 2,961 Ether. The stolen assets were valued at $6.34 billion.

Blockchain analytics firm Chainalysis estimated losses from North Korea-linked fake interviews and malware attacks over the past 18 months at $14.3 million.

Park Si-on, Hankyung.com reporter ushire908@hankyung.com