Binance's $6.3 Billion Heist: A Masterclass in Basic Social Engineering

Binance has confirmed a record-breaking $6.3 billion cryptocurrency theft carried out by North Korean hackers, according to reporting from TechCrunch. The heist, which prompted the exchange to freeze customer withdrawals, was the result of a months-long social engineering campaign.

As detailed by TechCrunch, the breach began when hackers posing as recruiters contacted a Binance software engineer specializing in wallets. After two interviews, the engineer downloaded a fake coding assignment that contained malicious code, compromising their work laptop. Binance admitted its security tools failed to detect the malware.

This initial foothold allowed attackers to compromise two additional engineers on the wallet team. One had previously downloaded a tampered app via a search engine, while another's system was accessed using stolen credentials. This chain of failures granted the hackers access to systems controlling billions of dollars in assets.

While Binance characterized the event as a persistent threat from state-sponsored actors—noting it had faced 57 suspected North Korean attacks—TechCrunch reports that these specific tactics are widely known. Cybersecurity firms and the U.S. government have issued repeated warnings for years regarding North Korean operatives posing as recruiters, venture capitalists, and investors. Furthermore, half of all intrusions at U.S. tech companies last year were linked to North Koreans posing as fake recruiters or remote IT workers.

Binance stated the attack "should not have happened" and has since implemented new security measures and hired external experts to review the incident. When questioned by TechCrunch, a Binance spokesperson declined to provide on-the-record details regarding how the company prevents unauthorized code from running on employee laptops or whether prior cybersecurity audits had been conducted.