The exchange's defenses thwarted dozens of suspected attacks before hackers used a staged recruitment process to infiltrate its wallet systems.
Binance said it thwarted 57 suspected North Korea-linked cyber threats in 2026, yet a fake interview compromised one of its engineers.
The disclosure, in the exchange's Nov. 3 security report, reveals how attackers used a recruitment scam involving staged interviews, fabricated identities, and malicious software to access systems involved in the $6.34 billion cryptocurrency theft on Oct. 29.
“Throughout 2026, Binance's security team detected and prevented 57 suspected North Korea-linked cyber threat cases. These attempts reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry. The techniques include fraudulent job interviews, malicious software disguised as popular developer tools, compromised software packages and browser extensions, fake video conferencing applications, and social engineering campaigns designed to steal credentials or deploy remote access malware. We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.”
The operation succeeded despite Binance's security team identifying and preventing dozens of suspected North Korean intrusion attempts during the year, including campaigns using fraudulent job interviews and compromised developer tools.
The FBI attributed the theft to North Korea's TraderTraitor operation on Oct. 31, describing an ongoing effort to steal cryptocurrency and launder the proceeds through decentralized finance platforms.
Binance's findings expose a troubling gap between recognizing a persistent threat and preventing its execution.
The campaign's earliest identified stage occurred in June, when a Binance wallet infrastructure engineer downloaded a tampered Homebrew installer while attempting to install a popular AI coding tool.
Source link
