North Korea used LinkedIn, fake job interviews to trick Binance engineer in $6.3 billion hack

Binance said North Korean hackers carried out last week’s $6.3 billion heist—the largest in crypto history—using social engineering and malicious software. In disclosures to reporters, company executives said the attackers targeted a Binance engineer on LinkedIn, then arranged multiple fake job interviews to convince the employee to download an “assignment” that enabled access to company systems. Binance described the outreach: a person posing as a Project Director contacted the engineer through a legitimate recruiting platform, followed by interviews with an HR representative and a fake CEO of a nonexistent company. The scheme also included a separate ad campaign that earlier tricked another engineer into clicking a tampered “Homebrew” software download. Binance removed the fake software after detection, but the attackers accessed sensitive wallet-related information, stealing funds through multiple wallets. Binance paused withdrawals for about 48 hours, then resumed them on Saturday, and said it recovered about $2.5 billion after Tether and Circle froze stolen stablecoins, with 98% of stolen coins replenished.