A coding assignment. That’s what it took to crack the world’s largest crypto exchange. Binance has now confirmed that North Korean hackers, posing as recruiters, got a wallet engineer to open a booby-trapped file and walk them into a record $6.3 billion theft.
In an updated statement on X, which TechCrunch reported on Tuesday, Binance said the attackers used fake social media profiles and a job offer. After two interviews, the engineer was told to download a take-home assignment. It carried malicious code that compromised the work-issued laptop. Binance says its security tools did not detect it.
From there, the hackers reached an internal tool that could take over the computers of two other wallet engineers. One of them had months earlier downloaded a tampered app, found through a search engine, that stole passwords. Binance replaced that laptop. But the stolen credentials were still good, and the attackers used them to get into a third engineer’s machine, one with access to systems that control billions in crypto.
Read that chain again. A work laptop ran untrusted code. An internal tool let one compromised machine reach others. Credentials survived a hardware swap. None of this is exotic. These are basic hygiene failures at a company holding customer funds at enormous scale.
Binance says the attack “should not have happened,” which is true and also not very useful. The company referred TechCrunch to its public statement and declined to answer on the record how it stops unauthorized code from running on employee laptops, or whether outside firms audited its network before the hack. Those are the questions users should be asking too.
The tactic is no surprise. Researchers and the U.S. government have warned for years that North Korean operatives pose as recruiters, investors and venture capitalists, often using stolen American identities. Roughly half of intrusions at U.S. tech companies last year were tied to North Koreans posing as remote IT workers or fake recruiters. Binance itself counts at least 57 suspected attacks from the country. The FBI and blockchain investigators blame Pyongyang for this one, and the regime has long been accused of stealing crypto to fund its sanctioned nuclear weapons program.
So the lure wasn’t new, and Binance knew it was coming. Blaming one engineer for taking the bait misses the point. People will click on job offers. A company at this scale should be built so that one click can’t reach billions of dollars, with application allowlisting, locked-down work devices and tight limits on internal tools.
For customers, the practical effect is already here: withdrawals were suspended across the network. Binance promises outside experts and new security measures, but offers no detail. Until it does, “trust us” is a thin guarantee from the exchange behind the largest crypto theft in history.