← Back to overview

North Korean hackers conducted a sophisticated social engineering attack against Binance by using a fake job interview to trick an employee into installing malware. The malware allowed the attackers to compromise Binance's wallet infrastructure, resulting in the theft of approximately $6.34 billion in digital assets. This attack is attributed to North Korean state-sponsored threat actors, consistent with the Lazarus Group's known tactics of targeting cryptocurrency exchanges. The use of fake job interviews as an initial infection vector is a well-documented technique employed by North Korean cyber actors. This represents one of the largest cryptocurrency heists in history, highlighting the severe financial impact of social engineering combined with malware deployment against major crypto platforms.

Affected products

  • Binance

Related threat actors

  • Lazarus Group
  • North Korea

Categories

  • Data Breach & Exfiltration
  • Identity & Access
  • Ransomware & Malware