Binance stopped 57 North Korean cyber threats but fell for a fake job interview
Summary
Binance reported that a fake recruitment process helped attackers compromise engineers and steal $6.34 billion in cryptocurrency on Oct. 29, despite the exchange blocking 57 suspected North Korea-linked threats during 2026. Attackers used malware in a coding assignment to access employee systems, move laterally, obtain a deployment token and reach wallet-signing infrastructure. The FBI attributed the theft to North Korea’s TraderTraitor operation. Binance says it replaced affected devices, revoked credentials, rebuilt wallet infrastructure and strengthened developer protections and monitoring.
