How a Fake Job Interview Led to an 8 Trillion Won Crypto Heist: Inside the North Korean Hacker Scheme

North Korean hackers carried out a highly sophisticated multi-stage attack over a five-month period starting in June to hack the cryptocurrency exchange Binance.

Binance released an initial investigation report detailing the incident on the 3rd, local time.

The report stated that the incident involved supply chain malware attacks, internal AI tool hacking, and even social engineering tactics.

In June, the attackers first launched a supply chain attack by tricking an engineer, designated as Engineer A, who was in charge of developing and operating Binance's cryptocurrency wallets, into downloading a modified development tool.

Although Binance's security team detected abnormal signs at the time and took measures such as replacing devices and updating authentication credentials, the personal information of wallet infrastructure team members was exposed to the hackers.

About three months later in September, North Korean hackers approached an engineer named Engineer B through a job platform, launching a social engineering attack that involved a fake recruitment process.

During the first video interview, the interviewer used deceptive tactics to build trust with B, such as sharing a social media account containing photos of their personal life.

In the second interview, an individual posing as a chief executive officer had B download software containing malicious code onto their work computer under the pretext of completing a test assignment.

The malicious code exploited a zero-day vulnerability that went undetected by security tools at the time, replacing normal development tools with malicious versions.

Using B's computer infected in this manner, the hackers exploited internal AI tools on October 20 to step-by-step gain control over A and Engineer C, eventually securing the program deployment authentication keys held by A.

North Korean hackers logged into C's computer on the 29th, the day of the theft, and deployed programs they created using A's authentication key to execute the attack.

The hackers first made unauthorized withdrawals of 233.46 million XRP over a four-minute span starting at 8:05 PM Coordinated Universal Time (UTC) on the 30th at 5:05 AM Korean Standard Time, followed by transfers of 970,500 Solana and 44.2 million Optimism tokens.

They subsequently transferred 18,270 Bitcoins and 2,961.9 Ethereums.

Particularly in the process of attacking the Ethereum network, they bypassed normal withdrawal infrastructure by abusing approval privileges to obtain delegation authorization for asset withdrawals through 50 pre-prepared pre-signatures.

Binance reset the delegation code at 12:10 AM on the 30th, about four hours after the attack began (9:10 AM Korean Standard Time), blocking further outflows, but a substantial amount of cryptocurrency had already been stolen.

Binance has rebuilt the compromised wallets and internal AI tools, and is conducting security audits with external independent institutions.

The virtual assets affected by this incident total 6.34 billion dollars, or approximately 8.4 trillion won, of which 2.85 billion dollars (about 3.8 trillion won) have been frozen or blocked through cooperation between the exchange and issuers.

Furthermore, Binance has covered over 98% of the losses resulting from this incident by mobilizing its own reserves, the User Security Asset Fund (SAFU), and futures insurance funds.

Binance stated that taking this incident as an opportunity, it is expanding investments in AI-based detection technology and pursuing the establishment of an AI security research fund for the virtual asset environment in collaboration with major AI companies.

Binance added that throughout 2026, it has detected and blocked 57 cyber threat cases suspected of being linked to North Korea.
※ Please note: This article was translated by AI and may contain errors.