Binance said North Korean-linked TraderTraitor stole about $6.3 billion in cryptocurrency after a months-long attack involving fake job interviews and zero-day malware. Separately, Binance is investigating an unverified ShinyHunters extortion claim and warned customers to expect follow-on phishing attempts seeking passwords, 2FA codes, seed phrases, and private keys.
According to reporting, the TraderTraitor group, described as North Korean actors, carried out a months-long, multi-stage operation against Binance that combined fake job interviews with zero-day malware. This allegedly resulted in approximately $6.3 billion in virtual currency being stolen. The use of fake recruitment as an entry point reflects a broader pattern where technical job seekers, including software engineers and developers, are lured into interactions that ultimately deliver malware or compromise credentials.
Separately, Binance is investigating a claim from a group calling itself ShinyHunters, which said it possessed 335.9 million Binance customer records and demanded $900,000, framing the demand as "pay or leak." Binance stated this appears likely to be a scam rather than evidence of an actual systems breach.
Fake job interviews work because they exploit trust built around a legitimate-seeming hiring process. Targets such as developers and technical job seekers may be asked to run code, open files, or install software as part of an interview exercise, activities that feel routine in a technical recruitment context but can deliver malware undetected. Combined with zero-day exploitation, this gave attackers a path into systems that standard defenses were not prepared to catch.
The extortion claim adds a second layer of risk: even when a breach claim is unverified, the surrounding uncertainty and urgency can be exploited to pressure customers and staff into hasty action.
Binance specifically warned users to be alert for follow-on phishing attempts seeking passwords, 2FA codes, seed phrases, and private keys in the wake of this incident.
This case illustrates how impersonation techniques, including fake recruiters, can bypass technical defenses by targeting human trust during a routine process like a job interview.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TraderTraitor, described as North Korean actors, ran a months-long, multi-stage attack involving fake job interviews and zero-day malware that allegedly resulted in about $6.3 billion stolen in virtual currency from Binance.
No, Binance said the claim of possessing 335.9 million customer records was likely a scam rather than evidence of a systems breach, though ShinyHunters demanded $900,000.
Binance warned users to expect follow-on phishing attempts seeking passwords, 2FA codes, seed phrases, and private keys.
The targets include software engineers, developers, technical job seekers, cryptocurrency exchange employees, and cryptocurrency users.
A job interview can be the first step in a crypto theft. Binance says TraderTraitor used fake interviews in a months-long attack involving zero-day malware. The reported loss: roughly $6.3 billion in crypto. And a separate ShinyHunters breach claim? Binance found no evidence of a systems breach. A message about it could instead ask for your password, 2FA code, seed phrase, or private key. The tell: an interview wants a file, or an alert wants secrets. Verify it through the company's official site before doing anything.
Attackers allegedly used a fake recruiting process to trick a Binance engineer into running a coding assignment on a work computer. The malicious assignment gave the attackers a foothold, which they reportedly used with stolen deployment access and an internal AI tool to reach wallet systems and…
Attackers linked to North Korea allegedly used a fake recruitment process to persuade a Binance software engineer to download a malicious coding assignment onto a work computer. They then used the compromised device, internal AI tooling, and stolen deployment credentials to reach wallet-signing…
Binance says North Korean-linked attackers used a fake recruiting process to trick an engineer into downloading a malicious coding assignment. The attackers then spent weeks moving through internal systems before abusing a wallet-signing service to move funds outside normal withdrawal controls.…
Binance says attackers linked by U.S. agencies to North Korea used fake recruitment interviews to trick a software engineer into downloading a malicious coding assignment. The compromise spread from one employee device to other systems and ultimately enabled unauthorized cryptocurrency transfers…
The FBI attributed the theft of roughly $6.3 billion from Binance to North Korea's TraderTraitor operation, which is linked to the Lazarus Group. The reported Binance breach began with a compromised DevOps engineer laptop, while the group has previously used fake job offers and recruitment…
The newsletter reports that Binance attributed a record-setting $6.43 billion theft to a sophisticated, multi-stage campaign. Attackers reportedly used recruitment-themed social engineering against two engineers and a tampered Homebrew installation, showing how a convincing job-interview pretext…
