North Korean hacking warnings preceded Binance’s record $6.3B crypto heist

Binance says North Korean hackers used fake social media profiles and the lure of a potential job offer in a months-long scheme targeting an employee. According to the company, a software engineer who worked on wallets was asked to download an apparent coding assignment after two interviews, and the file contained malicious code. Binance said its security tools did not detect the malware, and the attack led to the theft of a record $6.3 billion in crypto.

Researchers have repeatedly warned that North Korean hacking campaigns can rely on patient, long-running social engineering. TechCrunch reports that hackers tied to North Korea have posed as venture capitalists, investors, and recruiters using stolen American identities to trick employees into granting access to systems. The FBI and blockchain investigators blamed North Korea for the Binance heist, while the country has long been accused of using major crypto thefts to fund its internationally sanctioned nuclear weapons program.

TechCrunch reports that the initial foothold let hackers access an internal tool capable of taking over work computers used by two other wallet-team engineers. One engineer had previously downloaded a tampered app containing password-stealing malware, and stolen credentials were later used to break into a third engineer’s computer. Binance said the attack “should not have happened,” said it improved network security, and said it would bring in cybersecurity experts to review the incident.

The incident highlights why recruiting outreach, coding assignments, and unsolicited software downloads should be treated as high-risk in crypto environments. The article also underscores a core defensive point: companies are responsible for ensuring systems cannot run unauthorized or untrusted software that could cause a compromise. Teams handling wallets or high-value crypto systems should scrutinize internal remote-access tools, credential exposure, and employee device controls before attackers turn one compromised laptop into broader access.