Binance postmortem details months-long North Korean operation behind record heist
Seven Lights
Binance published a postmortem this week detailing a months-long North Korean operation: a fake job offer, malicious software and abuse of the exchange’s own internal artificial-intelligence tool, ending in the theft of about $6.34 billion in digital assets on October 29, the largest cryptocurrency robbery on record. The Federal Bureau of Investigation has attributed the attack to a North Korean unit it calls TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38.
The company said in a statement updated on X that the operation began in June, when an engineer was tricked into downloading tampered software, reportedly after a search-engine advertisement served up a malware download. Fake social media profiles and the lure of a job offer anchored the approach, according to TechCrunch, which noted that researchers had warned for years of North Korean social-engineering campaigns lasting months. The attackers concealed their activity and removed traces of the compromise, complicating detection.
By October 20, the postmortem states, the intruders had used Binance’s internal AI tool to gain control over wallet credentials belonging to the first compromised engineer and to a third employee. On October 29 they logged into that employee’s computer and moved the funds. Binance said it could not halt the transfers, which continued for nearly two hours, because its hot wallet used multi-party computation: no single private key existed that could immediately revoke the malicious authorisations the attackers had obtained.
Chief Executive Richard Teng said no customer would bear losses, with about $2.85 billion in stolen assets frozen or intercepted. He said 98 per cent of affected tokens had been replenished, with the remainder being completed, and that withdrawals had broadly resumed. Binance said it had turned back 57 suspected North Korea-linked threat cases, language reflecting what it called the persistent threat from state-sponsored actors targeting the cryptocurrency industry.
The episode follows a familiar pattern documented across the sector. Some half of all intrusions at United States technology companies last year were attributed to North Koreans posing as remote information-technology workers and fake recruiters, and a 2021 theft at the game company Axie Infinity likewise began with a fabricated job offer on LinkedIn. The government and cybersecurity firms had issued repeated warnings of the tactics in the years before the Binance loss.
Investigators are expected to focus on how the engineer consented to the software despite those warnings, and on the internal systems the attackers abused. Binance said its review of the compromise continues.