Binance says North Korean hackers stole record $6.3B in crypto

Binance said North Korean hackers used fake social media profiles and the lure of a job offer in a months-long operation that ended with the theft of $6.3 billion in crypto, which the company described as a record. The hack, disclosed in an updated statement posted on X on Tuesday, led the exchange to suspend customer withdrawals across its network.

The FBI and blockchain investigators have blamed North Korea for the heist. The country has been accused of carrying out large cryptocurrency thefts in recent years to fund its nuclear weapons program, which is subject to international sanctions.

According to Binance, hackers posing as recruiters contacted a software engineer who works on wallets at the company. After two interviews with the purported company, the engineer was told to download an apparent coding assignment, which contained malicious code that compromised the work-issued laptop. Binance said its security tools did not detect the malware.

That access let the hackers reach an internal tool capable of taking over the work computers of two other engineers on the wallet team. One of them had downloaded a tampered app containing password-stealing malware months earlier after finding the software in search engine results. Binance replaced that engineer's laptop, but the hackers used the stolen credentials to break into the computer of a third engineer whose job gave access to systems controlling billions of dollars in crypto.

Binance said the attack "should not have happened" and that it had improved network security after the theft. By the company's account, it has faced at least 57 suspected attacks from North Korea, which it said reflect the "persistent threat posed by state-sponsored actors targeting the cryptocurrency industry."

Binance spokesperson Ross O'Leary referred to the company's public statement and declined to answer questions on the record about how Binance prevents unauthorized code from running on employee laptops and whether third parties had audited its network before the hack. The company said it would bring in cybersecurity experts to review the incident and has put new security measures in place.