Binance Says North Korea-Linked Hackers Stole $6 Billion Using Fake Interviews and AI Tool
Reporting based primarily on en.yna.co.kr.
Binance Details $6.34 Billion Crypto Theft
Binance, the world's largest cryptocurrency exchange, said Tuesday that hackers used fake job interviews and an internal artificial intelligence (AI) tool in a cyberattack that resulted in the theft of more than US$6 billion in digital assets last week. [1] The U.S. Federal Bureau of Investigation's (FBI) has attributed the theft to North Korea, identifying the incident to a North Korean hacking group it calls TraderTraitor, a name previously tied to other cryptocurrency thefts. [1] In its latest findings, Binance said approximately $6.34 billion in digital assets were affected by a multi-stage operation that involved fake interviews and internal AI tool and suspected of being carried out as early as June. [1] Binance reported that the operation led to the theft of more than US$6 billion in digital assets. [1] The exchange detailed how the incident unfolded over several months and resulted in approximately $6.34 billion in digital assets being affected. [1] This amount represents the scale of the breach that Binance disclosed on Tuesday. [1]
Role of Fake Interviews and Internal AI Tool
In September, a fake recruiter on a job platform ran video interviews and sent an "assignment" repository carrying 0-day malware undetected by endpoint tools. [1] According to Binance, the attacker used an internal AI tool on Oct. 20 as a springboard to reach a container deployment token and later deployed a container to trigger the attack. [1] The multi-stage operation began as early as June and incorporated these deceptive interviews along with the misuse of Binance's own systems. [1] The fake recruiter conducted video interviews in September before sending the malware through the assignment repository. [1] On Oct. 20 the attackers leveraged the internal AI tool to access the container deployment token. [1] This sequence allowed the operation to progress undetected until the final deployment of the container that triggered the breach. [1] Binance described how the combination of the fake interviews and the AI tool misuse formed the core of the attack method. [1]
FBI Attributes Attack to North Korean Group
The U.S. Federal Bureau of Investigation's (FBI) has attributed the theft to North Korea, identifying the incident to a North Korean hacking group it calls TraderTraitor, a name previously tied to other cryptocurrency thefts. [1] The FBI findings link the group directly to the Binance incident and note prior connections to cryptocurrency thefts. [1] Binance referenced the FBI attribution in its report on the multi-stage operation. [1] The identification of TraderTraitor as the responsible party comes from the FBI's analysis of the attack. [1] This attribution aligns with the details Binance provided about the timing and methods used in the breach. [1]
North Korea Rejects Allegations
On Tuesday (Korean time), Kim Yo-jong, the powerful sister of North Korean leader Kim Jong-un, flatly dismissed the findings of the FBI, calling it a "grave political provocation" against Pyongyang. [1] Kim Yo-jong rejected the FBI attribution in direct response to the reported findings. [1] The dismissal characterized the allegations as a serious political provocation. [1] This statement from Kim Yo-jong came on Tuesday in Korean time following the Binance disclosure. [1]
U.S. Government Response
The U.S. State Department reiterated concerns over North Korea's use of cybercrime to finance its weapons programs. [1] The issue of DPRK cybercrime is a global problem that touches companies and jurisdictions around the world, including the United States, a U.S. State Department spokesman told Yonhap News Agency. [1] The State Department referred to North Korea's official name, the Democratic People's Republic of Korea, when addressing the matter. [1] This position highlights the broader implications of the cybercrime activities attributed to the DPRK. [1] The spokesman emphasized that the problem extends beyond any single company or country. [1]
Binance's Defensive Measures
Binance said it blocked 57 suspected North Korea-linked threats this year. [1] The exchange reported taking these actions as part of its ongoing security efforts. [1] This total reflects the number of suspected threats blocked by Binance throughout the year. [1] The defensive measures include monitoring and responding to activities suspected of North Korea links. [1]
What to watch next centers on continued monitoring of similar multi-stage operations that begin with fake recruitment and escalate through internal tool misuse, as described in the Binance report. [1] Additional scrutiny may apply to other cyber incidents reported in various regions. [3]
