North Korean hackers have reportedly stolen approximately $6.34 billion worth of cryptocurrency from Binance, the world's largest cryptocurrency exchange, by using fake employment schemes and artificial intelligence (AI) tools. The hackers infiltrated the internal systems after planting malware on an employee's work computer.
On November 3, Binance released a report detailing the initial findings and response to the security incident that occurred on October 29.
According to the report, the attack began in June when hackers tricked a Binance engineer into downloading a modified development tool. Although the security team detected unusual activity and replaced the device, information from the cryptocurrency wallet management team was exposed to the hackers during this process.
In September, another engineer became a target of a fake job interview. The hackers posed as representatives of a fictitious company on a job platform and conducted video interviews with job seekers. They then lured candidates into downloading files containing malware under the pretext of completing a task. This malware operated by modifying legitimate development tools, evading detection by existing security programs.
Furthermore, on October 20, the hackers used the infected computer and Binance's internal AI tools to penetrate the systems of two additional engineers. They accessed the cryptocurrency wallet's transaction approval system using stolen credentials and illicitly transferred Bitcoin, Ethereum, Solana, and XRP to external wallets on October 29.
Binance halted withdrawals and began freezing assets in collaboration with related firms, but they were unable to immediately prevent further leaks due to malicious transaction approval permissions set on the blockchain. The company reported that it had frozen or blocked the movement of $2.85 billion of the stolen assets out of the total $6.34 billion.
The FBI identified the North Korean-linked hacking group 'TraderTraitor' as responsible for the attack on October 31. This group is also believed to be involved in the $1.5 billion hacking incident of Bybit last year.
North Korea has categorically denied these allegations. Kim Yo-jong, Deputy Director of the Workers' Party of Korea, dismissed the FBI's claims as 'absurd rumors' on November 3, asserting that the U.S. is attempting to label North Korea as a cybercrime nation.
Meanwhile, North Korea's use of fake employment schemes targeting other countries appears to be expanding. In August, U.S. media outlet Voice of America reported that North Korean operatives are extending their deceptive employment tactics beyond traditional information technology (IT) roles to various remote work fields, including healthcare and marketing.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.