Researchers warned of North Korean hacking tactics years before record $6.3B Binance heist

What happened

North Korean hackers posed as recruiters with fake social media profiles. They offered a job to a software engineer who works on crypto wallets at Binance. After two fake interviews, the engineer downloaded a coding test that had hidden malware. The malware infected the engineer's work laptop, and Binance's security tools did not catch it. The hackers then used that access to move through the company's network and steal $6.3 billion in crypto. Binance paused customer withdrawals across its network.

Key numbers and facts

• Stolen amount: $6.3 billion, a record for this kind of theft.
• The attack took months of planning and patient work.
• Binance said it faced at least 57 suspected attacks from North Korea.
• Some half of all intrusions at U.S. tech companies last year were tied to North Koreans posing as remote IT workers and fake recruiters.

Why North Korea is involved

The FBI and blockchain investigators blame North Korea for the theft. North Korea is under international sanctions, which limit its trade. Experts say it steals crypto to raise money for its nuclear weapons program. Researchers have warned for years about fake job offers and fake investors used to trick workers into letting hackers in.

Why it matters

This is one of the biggest crypto thefts ever recorded. It shows that even a large, well-known company can be fooled by people who pretend to be recruiters. The case also raises questions about how Binance let malware run on work laptops. Binance said the attack "should not have happened" and that it has improved its security.

What to watch

• Whether investigators find out how the fake job offer got past warnings and security checks.
• Whether Binance explains how it stops harmful software on employee laptops.
• Whether outside cybersecurity experts check Binance's network, as the company said it would do.
• When Binance fully restores customer withdrawals.