Binance Says Fake Job Interview Led to $6.34 Billion Crypto Theft
Summary
Binance says a fake job interview led an employee to install malware, enabling attackers attributed by the FBI to North Korean group TraderTraitor to access wallet infrastructure and steal about $6.34 billion in cryptocurrency.
Key points
- Binance says the attack began in September when a fake recruiter targeted a software engineer and provided a malicious coding assignment.
- The assignment reportedly installed custom macOS malware that replaced a Homebrew pyenv executable and enabled attackers to run commands from an external server.
- By October 20, attackers had reportedly compromised two more wallet-infrastructure employees, obtaining credentials and a container deployment token.
- Binance says the attackers used stolen credentials on October 29 to access its wallet signing service and steal about $6.34 billion across multiple blockchains.
- The article says the FBI attributed the attack to North Korean state-sponsored group TraderTraitor, also known as Lazarus Group, Jade Sleet, and APT38.
- Binance says it rebuilt affected systems and revoked stolen credentials; about $2.85 billion had been frozen or intercepted by November 3, and 98% of impacted token assets had been replenished by October 31.
- Binance has not linked the employee compromise to Contagious Interview or Operation Dream Job, though the article notes similarities to those campaigns.
Article Details
- Victim Organization
- Binance
- Incident Type
- Social engineering and malware-enabled compromise of wallet infrastructure, followed by cryptocurrency theft
- Incident Date
- 2026-10-29
- Disclosure Date
- 2026-11-03
- Data Types Exposed
- Digital assets
- Employee credentials
- Container deployment token
- Affected Data Size
- Approximately $6.34 billion in digital assets stolen.
- Operational Impact
- Attackers gained unauthorized access to Binance's wallet signing service and transferred cryptocurrency across multiple blockchains. Binance suspended withdrawals. As of 2026-11-03, approximately $2.85 billion in stolen assets had been frozen or intercepted; Binance said 98% of impacted token assets had been replenished as of 2026-10-31.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1059.004 · Unix ShellThe malicious replacement executable used to run commands spawned a Z shell (zsh) process.T1078 · Valid AccountsAttackers used stolen credentials to access Binance's wallet signing service.T1204.002 · Malicious FileAn employee executed a malicious coding assignment, which Binance said compromised the employee's device.
Threat Actors
APT38The article says TraderTraitor is also tracked as APT38; the FBI attributed the attack to this tracked group.Jade SleetThe FBI attributed the attack to North Korean state-sponsored hackers identified as TraderTraitor.Lazarus GroupThe article says TraderTraitor is also tracked as Lazarus Group; the FBI attributed the attack to this tracked group.