Binance has published its own account of how roughly $6.3 billion left its coffers, and the entry point was a hiring pipeline rather than a firewall. The exchange says a developer was compromised during a recruitment process that security researchers attribute to North Korea’s TraderTraitor crew.
The mechanics follow a pattern repeated across the industry this year. A candidate who looked legitimate handed over a coding assignment and an AI-assisted development package. Opening the repository ran malicious code on the engineer’s workstation, which held credentials into build tooling and wallets.
According to coverage of Binance’s disclosure, the attacker moved through a compromised laptop that connected to production systems, then converted access into signatory rights and transferred funds within minutes. SecurityWeek reports that a rigged coding assignment and an abused AI development tool led to the loss.
The technique is not novel, and that is the concern. Coding challenges, fake recruiters, and poisoned development dependencies have become the standard route into cryptocurrency firms, and each success funds the next round of research and infrastructure.
Kinetic signals followed. Pyongyang publicly rejected the United States’ attribution of the heist, while South Korea’s military reported missile launches toward the sea the same week, according to SecurityWeek. Attribution debates aside, the FBI has tied earlier DPRK crypto thefts to the same crew.
The defensive marker is worth copy-pasting into any hiring playbook. Third-party code sent by a candidate is untrusted software, and running it on a developer’s primary workstation is the moment a job interview becomes an intrusion. Build recruiters a disposable environment for exercises, and never let the machine that opened the assignment hold wallet or cloud keys.
