North Korean Hackers Used Fake Job Interviews to Plant Malware at Binance

Posing as CEOs and interviewers to lure employees

Attack prepared over five months

A North Korean hacking group stole cryptocurrencies after luring Binance employees through fake job interviews, according to an initial investigation report released by the world’s largest digital-asset exchange.

Binance published the report on Nov. 3. The exchange said the hacking campaign began in June, when Binance engineer A downloaded a tampered coding installation program. Binance replaced the employee’s computer, but information on the engineer’s role and colleagues was exposed to the hackers.

The group also carried out a fake job interview in September with Binance engineer B through a job platform, the report said. In the first video interview, a person posing as an interviewer showed B a social media account to build familiarity. In the second interview, another person posing as a chief executive officer tricked B into downloading malware-laced software onto a work computer by presenting it as an assignment.

Using information obtained that way, the hackers logged into the computer of another engineer, C, on Oct. 29. They then used engineer A’s credentials to run malicious software and steal digital assets on a large scale. The attackers took 233.46 million XRP, 970,500 Solana and 44.2 million Optimism tokens from Binance’s hot wallet, an internet-connected wallet. They also stole 18,270 Bitcoin and 2,961 Ether. The stolen assets were valued at $6.34 billion.

Blockchain analytics firm Chainalysis estimated that North Korea-linked fake interviews and malware attacks caused $14.3 million in losses over the past 18 months.

Park Si-on, Hankyung.com reporter ushire908@hankyung.com