Binance has revealed how North Korean hackers spent months preparing to steal approximately $6.34 billion in cryptocurrency last week. According to a November 3 security report by the exchange, the attackers used a malicious Homebrew installation to compromise one engineer and a fake recruitment process to trick another into installing malware disguised as a coding assistant. "Our current investigation indicates that this was a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident," the exchange said.
Binance says the first known compromise occurred in June, when an engineer in Binance’s Wallet DevOps team searched online for a popular AI coding tool and downloaded an adulterated Homebrew installation. Homebrew is a package manager, used by developers to install and manage various software tools on macOS.
Binance says it detected the unusual activity, replaced the engineer’s device, and rotated their associated credentials. However, those moves proved to be too little, too late, as the attackers had already learned about the employee’s role and identified colleagues working on the exchange's wallet infrastructure
The incident follows the compromise of another Binance software engineer who was contacted in September through a legitimate job hunting platform by a malicious actor posing as a project director. The fake recruiter arranged two interviews. One involved a purported HR representative who conducted a live video call and shared a social media account containing personal photos and videos to establish credibility, while the second involved someone posing as a CEO of a fictitious company.
Near the end of the interview, the engineer was asked to download a coding assignment containing a malicious software repository onto his work computer—a popular social engineering scheme. That malicious code executed during the setup process. At the time, Binance said the malware replaced a legitimate component of the Python version-management tool "pvenv" with a malicious version capable of executing commands and communicating with an attacker-controlled server. The exchange's endpoint security tools did not detect the malware at the time.
Those compromises began bearing fruit on October 20, as the attackers used the compromised computers associated with the fake interview and an internal AI tool to gain control over two wallet engineers' devices. They also discovered a container deployment permission token stored on the computer of the engineer initially targeted in June.
Later, on October 29, the attackers used stolen credentials to access another engineer's computer, deploy a container, and execute a malicious script. This gave them access to Binance's internal wallet signing service, allowing transactions from five hot wallets outside the exchange's normal withdrawal process.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
The U.S. FBI directly attributed the theft to North Korea on November 1. ”The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor," the agency tweeted. Pyongyang has distanced itself from the hack, describing the U.S. claims as "preposterous nonsense.”
Binance said it had since frozen or intercepted approximately $2.85 billion in compromised assets, while 98% of the affected funds have been replenished.
The tactics resemble previous North Korean-linked campaigns. WaterPlum attackers previously used fake job postings and coding tests to infect more than 30,000 devices across 100 countries, compromising over 7,000 crypto wallets in September. A 2024 campaign that targeted Python developers with fake job offers and malware hidden in code was attributed to the Lazarus group, which was also linked to the $1.5 billion Bybit hack in 2025. Attackers posed as potential employers and sent coding tests containing Base64 obfuscated malware. Running the tests could infect developers' computers, giving attackers remote access.
Newton Gitonga is a tech journalist covering gadgets, PC hardware, AI, data centers, and the wider tech industry. His interest in technology started early, taking apart things around the house to see how they worked, often to his dad’s frustration. His curiosity sometimes got the better of him, including a few failed attempts to fix laptops, one of them a gifted Dell XPS. He has previously written for Notebookcheck, ZyCrypto, CoinCentral, and Crypto News Flash.
3 hours ago
11
English (US) ·