JM

North Korea stole $6.3 billion from Binance by inviting one of its engineers to a job interview at a company that didn't exist. And the guy didn't even have access to the money. It took them five months and two separate hacks to pull this off. Back in June, an engineer on Binance's wallet team went looking for an AI tool and installed a tampered Homebrew package. Binance caught it, swapped the laptop and reset the passwords. Problem solved, they figured. Except by then the attackers already knew who worked on that team and what each person did. So they went recruiting. In September a different Binance engineer got a message on a real job site from someone calling himself a project director. First round was a video call with a fake HR person, who even shared a social media account full of personal photos so the whole thing felt legit. Second round was with the "CEO," who told him to download a coding assignment onto his work computer. It was loaded with malware nobody had seen before, and Binance's security software missed it completely. Then they waited. On October 20 they used his laptop plus one of Binance's own internal AI tools to get onto two wallet engineers' computers, and one of those engineers had permission to spin up new code on Binance's systems. Nine days later the attackers did exactly that. They ran a script and used an Ethereum feature called EIP-7702 to hand themselves control of a hot wallet, one of the wallets Binance keeps online to process withdrawals. Money started pouring out at 8:05pm UTC. It took Binance four hours to stop it, which works out to more than $25 million a minute. And it took that long because of a safety feature. Binance splits the signing power on those wallets into pieces held by different parties, so no single employee can ever drain one alone. That sounds great until something goes wrong, because it also meant nobody could hit the off switch on their own. For context, the previous record was Bybit's $1.5 billion in February 2025, also North Korea. This one is four times bigger. Binance has already refilled about 98% of it out of its own pocket and says customers won't lose a cent. Binance says it blocked 57 suspected North Korean attacks this year, and the one that got through started with a guy who just wanted a new job.