SBS NEWS

News > Economy

Hack Worth 8 Trillion Won Traced to Job Interview Trap

Hong Yeongjae

Published : Nov 5, 2026 1:07 AM

Video

[Anchor]

Cryptocurrency exchange Binance, which suffered a hacking attack worth about 8 trillion won, has released an investigative report detailing how the breach occurred. It has been revealed that North Korean hackers targeted the exchange's developers and carried out operations months in advance.

Here is a report by reporter Hong Yeongjae.

[Reporter]

The attack by North Korean hackers, confirmed through Binance's internal investigation into the massive damage worth around 8 trillion won, was carried out meticulously in stages starting four months before the incident.

In June, North Korean hackers first extracted personal information from Binance developers to scout out targets for attack.

Then in September, a job offer came to one of the developers through a recruitment platform.

An investigator with a Federal Bureau of Investigation (FBI) background who was interviewed by SBS analyzed that the hackers likely scouted their targets thoroughly in advance.

[Nick Carlsen / North Korea Specialist Investigator at TRM Labs: The reason they approached this developer is because they likely did a lot of research beforehand and already knew to some extent that the developer had access rights to the system they were trying to reach.]

After building rapport with the developer by even sharing social media accounts, the North Korean hacker demanded that the developer download a program under the pretext of undergoing a test by impersonating the CEO during the final interview.

Malicious code was hidden inside the program.

Using the infected computer of the developer, the hackers rummaged through the internal servers of the exchange and ultimately succeeded in the hacking attack on the scale of 8 trillion won.

[Moon Jong-hyun / Head of Genians Security Center: Binance probably did not have weak security. The core point here is that the attack is being launched through people. Attackers nowadays, especially state-sponsored hacking organizations including North Korea and many other sophisticated hacking technicians, are targeting people.]

Binance stated that it detected and blocked 57 cyberattacks suspected to be linked to North Korea this year alone, but it was helpless against the cunning infiltration methods of North Korean hackers that exploit human trust and psychology.

(Camera: Joo Yong-jin | Video Editing: Lee Seung-hee | Design: Park Tae-young)