Binance Details How North Korean Hackers Stole $6.3 Billion Through Fake Job Scheme

Binance disclosed on Tuesday that North Korean state-sponsored hackers penetrated its internal systems through an elaborate employment scam, executing the largest cryptocurrency heist in history with the theft of $6.3 billion in digital assets.

According to an updated post published by Binance on X and detailed by TechCrunch (https://techcrunch.com/2026/11/03/researchers-warned-of-north-korean-hacking-tactics-years-before-record-6-3b-binance-heist/), operatives established fake social media personas and posed as recruiters to contact a software engineer on the exchange's wallet team. Over several months, the attackers conducted two rounds of remote interviews before providing the engineer with what appeared to be a standard coding assessment. Opening the project file deployed malware onto the employee's corporate laptop, entirely undetected by Binance's endpoint security tools.

The compromise gave the intruders an initial foothold inside Binance's network, where they reached an internal administrative utility capable of taking control over workstations assigned to two other wallet engineers.

From there, the attackers exploited latent credential vulnerabilities. Months before the breach, one of those engineers had downloaded an infected application discovered through search engine results. Although Binance identified the problem and replaced that laptop, the hackers had already harvested stored credentials. Using those retained access keys, the attackers infiltrated the laptop of a third engineer whose role granted administrative access to systems governing billions of dollars in crypto reserves.

The resulting unauthorized transfers forced Binance to pause customer withdrawals across its network. The FBI and independent blockchain forensic investigators subsequently attributed the heist to North Korea, which has spent years orchestrating cryptocurrency thefts to finance its sanctioned nuclear and weapons development programs.

Binance acknowledged that the intrusion "should not have happened" and revealed it has repelled at least 57 previous intrusion attempts linked to North Korean threat actors. While the company stated that it has since upgraded access safeguards and engaged outside security specialists to review the breach, Binance spokesperson Ross O'Leary declined to answer questions submitted by TechCrunch regarding how untrusted executables were permitted to run on developer laptops or whether external auditors had reviewed the network prior to the attack.

Outside cybersecurity auditors are now slated to conduct an independent review of Binance's endpoint enforcement and credential handling, as investigators examine why workstation protections failed to halt malicious code execution across machines with access to critical wallet keys.