How North Korean Hackers Infiltrated Binance via Fake Job Interviews

The campaign began in June when a developer inadvertently installed a tampered file distributed via a malicious Google advertisement. Although Binance security teams flagged the initial breach and replaced the compromised hardware, the attackers maintained a persistent presence. By September, the hackers shifted tactics, targeting a second engineer through a protracted fake recruitment process. They conducted multiple interview rounds and leveraged social media to establish legitimacy, eventually tricking the employee into downloading a malicious assignment. This software successfully replaced a legitimate pyenv executable with a backdoor that evaded endpoint protection.

By October 20th, the attackers utilized Binance’s own internal AI tools to consolidate control over multiple employee accounts. The final strike occurred on October 29th when the hackers accessed a third employee's workstation to authorize illicit transfers. Binance noted that their Multi-Party Computation (MPC) hot wallet architecture prevented an immediate revocation of the unauthorized transactions, as no single private key could override the compromised EIP-7702 authorizations. The FBI has officially attributed the operation to the North Korean unit TraderTraitor, marking one of the most complex security failures in the exchange's history.