HighPhishing
North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist
Cyber Security News·Source published ·1 min read
What happened?
North Korean hackers used a fake job interview, a poisoned coding task, and a hijacked internal AI tool to reach Binance’s wallet systems. The FBI says the North Korean group it calls “TraderTraitor” stole more than $6 billion in digital assets on 29 October 2026. Binance puts the impacted value at about USD 6.34 billion. Binance says this was a multi-stage campaign and not a simple phishing case. In June 2026, a wallet DevOps engineer searched online for an AI coding tool and installed a tampered Homebrew package.
Key details
- North Korean hackers known as TraderTraitor stole over $6 billion from Binance using a multi-stage attack.
- The attack began when a wallet DevOps engineer installed a tampered Homebrew package in June 2026.
- A second engineer was targeted through fake job interviews and tricked into downloading a malicious assignment.
- Malware swapped a pyenv file, created a symlink, started a zsh shell, and evaded endpoint detection.
- Attackers used a compromised internal AI tool and a stolen container deployment token to access wallet systems.
- Binance cleared the on-chain delegation by authorizing the zero address but the signing key was not replaced.
Affected
- Binance wallet infrastructure and internal AI tool were compromised.
What to look for
- Tampered Homebrew package used to deliver malware.
- Fake job interviews with personalized social media content to build trust.
- Malware that swaps pyenv file, creates symlink, starts zsh shell, and wipes traces.
- Use of stolen container deployment token to deploy malicious container.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.