conv.

All stories
SecurityQuiet 4d · day 11

Binance Reveals Fake Job Interviews Triggered $6.3bn North Korea Hack

Binance's postmortem shows a bogus job interview and a tampered Homebrew installer opened the door to the largest crypto heist in history, as Pyongyang denies US and FBI attribution.

newest coverage 3d agosummary written 2d ago2.2k pieces121k likes & upvotes12k comments XNewswiresMastodonHacker NewsBlueskyRedditGoogle NewsYouTube

What to know

  • Binance's own postmortem traces the $6.3bn theft to a months-long chain starting with a tampered software installer and fake job interviews, not a single flaw.
  • The FBI has formally attributed the attack to North Korea's TraderTraitor group, which North Korea denies, and Pyongyang has since fired missiles after rejecting the claim.
  • Coverage has blurred 'recovering' stolen funds with Binance 'covering' losses from its own balance sheet; only a portion (~$1.8bn) was actually frozen by Tether and Circle.
  • HN commenters are split between dissecting the technical failures (AI tool misuse, lax CI/CD controls) and doubting whether North Korea's hacking groups are capable of a 20-minute, $6.3bn operation.

The dispute Whether the FBI's attribution to North Korean hackers is credible given the speed and scale of the theft, versus commenters who see the technical postmortem as the more convincing explanation. · positions read across 471 posts and comments

most voices

The real story is Binance's internal security failures — lax CI/CD controls, personal credential reuse, and an internal AI tool that let attackers escalate across engineers.

  • “the bigger failure mode to me is the Engineer C's container deployment token... CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software!”

    gandreani · Hacker News ↗
some voices

The North Korea attribution is suspicious given the scale and speed of the theft and the track record of blockchain-forensics firms.

  • “20 minutes?! $6.3B?! Their APT groups have been classified as advanced but not elite, this suggests a huge jump for their groups.”

    jas- · Hacker News ↗
some voices

The hack is a side debate to a broader argument over whether crypto's privacy and unbanked-access benefits outweigh its use for laundering and theft.

  • “It really isn't my bank or the government's business what I'm buying... Maybe this is all paranoia, but you see data breaches all the time”

    reorder9695 · Hacker News ↗

Changpeng Zhao (CZ) Binance founder, shareholderBinance Crypto exchange, hack victimFBI US law enforcement investigatorNorth Korea (Pyongyang) Accused state actor

Binance Reveals Fake Job Interviews Triggered $6.3bn North Korea Hack
x.com

How it unfolded 6 developments, newest first · click a bar or a number to jump articlesvideospostscomments

Peak 230 pieces in 3h at Oct 29, 10 PM; 2187 pieces over 11 days (1371 articles · 27 videos · 542 posts · 247 comments) Oct 28, 7 PM — 1 piece · 1 post — Mastodon 1Oct 28, 10 PM — quietOct 29, 1 AM — quietOct 29, 4 AM — quietOct 29, 7 AM — quietOct 29, 10 AM — quietOct 29, 1 PM — quietOct 29, 4 PM — 191 pieces · 115 articles · 61 posts · 15 comments — Newswires 95, X 39, Hacker News 19, +4 moreOct 29, 7 PM — 164 pieces · 99 articles · 52 posts · 13 comments — Newswires 70, Mastodon 33, Google News 27, +4 moreOct 29, 10 PM — 230 pieces · 188 articles · 1 video · 35 posts · 6 comments — Newswires 163, Mastodon 26, Google News 23, +5 moreOct 30, 1 AM — 92 pieces · 33 articles · 1 video · 33 posts · 25 comments — Mastodon 27, Reddit 23, Google News 17, +4 moreOct 30, 4 AM — 86 pieces · 27 articles · 5 videos · 29 posts · 25 comments — Mastodon 22, Hacker News 22, Newswires 18, +5 moreOct 30, 7 AM — 182 pieces · 117 articles · 4 videos · 33 posts · 28 comments — Newswires 76, Google News 36, Mastodon 28, +5 moreOct 30, 10 AM — 197 pieces · 127 articles · 4 videos · 37 posts · 29 comments — Newswires 112, Hacker News 32, Mastodon 26, +4 moreOct 30, 1 PM — 79 pieces · 47 articles · 2 videos · 18 posts · 12 comments — Newswires 38, Mastodon 15, Hacker News 12, +5 moreOct 30, 4 PM — 42 pieces · 26 articles · 1 video · 8 posts · 7 comments — Newswires 19, Hacker News 7, Mastodon 7, +3 moreOct 30, 7 PM — 20 pieces · 8 articles · 1 video · 8 posts · 3 comments — Mastodon 7, Newswires 6, Google News 2, +3 moreOct 30, 10 PM — 32 pieces · 20 articles · 8 posts · 4 comments — Google News 11, Newswires 9, Hacker News 4, +3 moreOct 31, 1 AM — 10 pieces · 2 articles · 2 posts · 6 comments — Hacker News 5, Mastodon 2, Reddit 2, +1 moreOct 31, 4 AM — 17 pieces · 7 articles · 1 video · 6 posts · 3 comments — Google News 6, Mastodon 4, Hacker News 3, +3 moreOct 31, 7 AM — 20 pieces · 11 articles · 4 posts · 5 comments — Newswires 6, Google News 5, Hacker News 4, +2 moreOct 31, 10 AM — 68 pieces · 47 articles · 1 video · 13 posts · 7 comments — Newswires 42, Mastodon 11, Hacker News 7, +4 moreOct 31, 1 PM — 28 pieces · 15 articles · 9 posts · 4 comments — Newswires 7, Google News 7, Mastodon 7, +2 moreOct 31, 4 PM — 22 pieces · 14 articles · 8 posts — Newswires 9, Mastodon 5, Google News 5, +2 moreOct 31, 7 PM — 26 pieces · 18 articles · 1 video · 7 posts — Newswires 13, Mastodon 5, Google News 5, +3 moreOct 31, 10 PM — 74 pieces · 61 articles · 13 posts — Newswires 48, Mastodon 13, Google News 11, +2 moreNov 1, 1 AM — 53 pieces · 48 articles · 4 posts · 1 comment — Newswires 41, Google News 7, Mastodon 3, +2 moreNov 1, 3 AM — 20 pieces · 14 articles · 6 posts — Newswires 7, Google News 6, Mastodon 4, +2 moreNov 1, 6 AM — 17 pieces · 9 articles · 1 video · 6 posts · 1 comment — Mastodon 8, Newswires 4, Google News 2, +3 moreNov 1, 9 AM — 21 pieces · 8 articles · 13 posts — Mastodon 13, Newswires 4, Google News 3, +1 moreNov 1, 12 PM — 44 pieces · 36 articles · 6 posts · 2 comments — Newswires 31, Google News 5, Mastodon 5, +2 moreNov 1, 3 PM — 16 pieces · 9 articles · 6 posts · 1 comment — Newswires 9, Mastodon 4, Reddit 2, +1 moreNov 1, 6 PM — 29 pieces · 24 articles · 5 posts — Newswires 15, Google News 9, Mastodon 5Nov 1, 9 PM — 13 pieces · 7 articles · 1 video · 5 posts — Mastodon 5, Google News 4, Newswires 3, +1 moreNov 2, 12 AM — 15 pieces · 10 articles · 4 posts · 1 comment — Newswires 6, Google News 4, Mastodon 4, +1 moreNov 2, 3 AM — 21 pieces · 15 articles · 5 posts · 1 comment — Newswires 8, Google News 6, Mastodon 5, +2 moreNov 2, 6 AM — 11 pieces · 7 articles · 3 posts · 1 comment — Newswires 5, Mastodon 2, Google News 2, +2 moreNov 2, 9 AM — 13 pieces · 7 articles · 6 posts — Mastodon 6, Newswires 4, Google News 2, +1 moreNov 2, 12 PM — 2 pieces · 1 article · 1 post — Google News 1, X 1Nov 2, 3 PM — 10 pieces · 7 articles · 1 video · 2 posts — Newswires 5, Google News 2, Mastodon 1, +2 moreNov 2, 6 PM — 33 pieces · 26 articles · 7 posts — Newswires 17, Google News 9, Mastodon 7Nov 2, 9 PM — 11 pieces · 6 articles · 1 video · 3 posts · 1 comment — Newswires 5, Mastodon 2, Reddit 2, +2 moreNov 3, 12 AM — 15 pieces · 12 articles · 3 posts — Newswires 7, Google News 5, Mastodon 3Nov 3, 3 AM — 5 pieces · 5 articles — Newswires 5Nov 3, 6 AM — 14 pieces · 12 articles · 2 posts — Newswires 9, Google News 3, X 1, +1 moreNov 3, 9 AM — 97 pieces · 74 articles · 23 posts — Newswires 65, X 9, Mastodon 8, +4 moreNov 3, 12 PM — 40 pieces · 16 articles · 15 posts · 9 comments — Mastodon 12, Hacker News 11, Newswires 9, +2 moreNov 3, 3 PM — 33 pieces · 11 articles · 20 posts · 2 comments — Mastodon 19, Newswires 7, Hacker News 3, +3 moreNov 3, 6 PM — 4 pieces · 1 article · 3 posts — Mastodon 2, Reddit 1, Newswires 1Nov 3, 9 PM — 5 pieces · 4 articles · 1 comment — Newswires 4, Hacker News 1Nov 4, 12 AM — 4 pieces · 3 articles · 1 post — Google News 2, Newswires 1, Hacker News 1Nov 4, 3 AM — 12 pieces · 9 articles · 2 posts · 1 comment — Newswires 9, Mastodon 2, Hacker News 1Nov 4, 6 AM — 2 pieces · 2 posts — Mastodon 2Nov 4, 9 AM — 24 pieces · 4 articles · 1 video · 2 posts · 17 comments — Hacker News 18, Newswires 3, Mastodon 2, +1 moreNov 4, 12 PM — 10 pieces · 2 articles · 1 post · 7 comments — Hacker News 7, Newswires 2, Mastodon 1Nov 4, 3 PM — 6 pieces · 1 post · 5 comments — Hacker News 6Nov 4, 6 PM — 2 pieces · 1 article · 1 comment — Hacker News 1, Newswires 1Nov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — 1 piece · 1 comment — Hacker News 1Nov 5, 6 AM — 1 piece · 1 comment — Hacker News 1Nov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — 1 piece · 1 article — Mastodon 1Nov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — 1 piece · 1 comment — Hacker News 1Nov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quiet 1–23456
Oct 29Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6yesterdaynow · 1:09 PM ET
  1. 6

    North Korea denies hack, fires missiles after rejecting US claims

    Pyongyang rejected the FBI's attribution of the Binance hack and said it saw no need to resume diplomacy with Washington, days after denying it was behind the $6.3bn theft; North Korea then conducted missile tests.

    “An engineer was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives, Binance says.”
    — BBC News, News outlet · source
    1. 29 outlets Blockchain analysis firm TRM says North Korea behind Binance crypto theft

      first by Reuters, 9d ago · also Cointelegraph, Forbes, Seoul Economic Daily, The Times, Stories Framing the Globe, Yahoo Finance +22

      33 more headlines
    2. 26 outlets Binance sees $4.7B in customer withdrawals after stunning North Korea hack

      first by NY Post, 6d ago · also BBC, Channel News Asia, Arab News, Fox Business, Japan Times, SCMP +19

      20 more headlines
    6 more claims →

    • A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of…

      gandreaniHacker News4d agoview on Hacker News ↗
    2 more of the top 3 · 35 posts in this stretch
    • jon_alper@mastodon.online

      RE: https:// mastodon.social/@arstechnica/1 17559032067718623 (Not dinging Ars here! I love Ars.) Let me fix that for you: “Binance admits that a series of security lapses over a period of at least months led to the theft of billions (when measured as alleged value in units of real money) in crypto.”

      jon_alper@mastodon.onlineMastodon4d agoview on Mastodon ↗

    • It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):https://isc.sans.edu/diary/32942It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was…

      sva_Hacker News4d agoview on Hacker News ↗
    all of them →
  2. 5

    Binance publishes postmortem detailing fake job interview scheme

    Binance's published postmortem said the breach began in June when an engineer searched for an AI coding tool and installed a tampered Homebrew installer; attackers later used an internal AI tool and a leaked container-deployment token to escalate access across multiple Wallet DevOps engineers, and a separate engineer was lured via fake job interviews through a legitimate job-hunting platform before the final theft.

    1. 28 outlets Fake job interview helps hackers drain $6.3 billion from Binance wallets

      first by Telegraph India, 5d ago · also Bloomberg, Channel News Asia, Investing.com News, Reuters, The National UAE, Help Net Security +21

      27 more headlines
    2. 9 outlets North Korea says claims linking it to Binance heist are 'absurd rhetoric,' KCNA says

      first by Channel News Asia, 5d ago · also Hindustan Times, France 24 EN, Japan Today, Daily Maverick, Reuters, Investing.com News +2

      6 more headlines
    3 more claims →

    • Binance published the postmortem on its $6.34 billion hack. It started in June. An engineer searched for an AI coding tool. Downloaded a tampered Homebrew installer. Binance caught it. Replaced the laptop. Rotated the credentials. But the attackers had already learned who

      @cyber_razzX4d ago5.6k▲view on X ↗
    2 more of the top 3 · 55 posts in this stretch
    • ai6yr@m.ai6yr.org

      Okay, what idiot uses their WORK COMPUTER to do a job interview?! Wait, was this guy WORKING FOR A CRYPTO EXCHANGE?!?! BleepingComputer: Binance says fake job interview led to $6.3 billion crypto heist "...Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that…

      ai6yr@m.ai6yr.orgMastodon4d ago135▲view on Mastodon ↗
    • raphae.li

      There it is, from the @reuters.com wire: BINANCE SAYS HACKERS USED BOGUS JOB INTERVIEW TO HACK EMPLOYEE AND STEAL CRYPTOCURRENCY

      raphae.liBluesky5d ago122▲view on Bluesky ↗
    all of them →
  3. 1 day quiet
  4. 4

    Journalist disputes 'recovered' framing of Binance's losses

    Crypto journalist Molly White noted that most coverage conflated Binance reimbursing users from its own funds with actually recovering stolen assets, arguing only a fraction was frozen and little of the rest is likely to be recovered.

    “Binance hasn't REcovered $6B+, it's COVERING it (reimbursing customers from company funds).”
    — molly0xfff
    1. 19 outlets Binance resumes Bitcoin, Ether withdrawals after $6.3 billion crypto hack linked to North Korea

      first by Hindustan Times, 7d ago · also WSJ Markets, WSJ, Seeking Alpha, CTV News, AP News, SCMP +12

      10 more headlines
    2. 13 outlets Binance Logs $3.64 Billion In Net Outflows After Reopening Withdrawals Following Record $6.3 Billion Hack

      first by Free Press Journal, 7d ago · also Cointelegraph, The Straits Times, The Information, Bitcoin Insider, CryptoSlate, TheStreet +6

      13 more headlines
    5 more claims →

    • Binance hasn’t REcovered $6B+, it’s COVERING it (reimbursing customers from company funds). Some was frozen, but Binance is not likely to recover even half. Bad headlines like this are a big part of why I started covering crypto. Generalist reporters on deadline far too often end up repeating company spin. # crypto # cryptocurrency # journalism

      molly0xfff@hachyderm.ioMastodon7d ago1.1k▲view on Mastodon ↗
    2 more of the top 3 · 33 posts in this stretch

    • "Raises questions..." 🤦‍♂️ Putting one's money in crypto is an elective choice. Most that put it in have NO idea how it really works. They just see the possibility of making money.

      williamgmanr/technology6d agoview on r/technology ↗
    • tsukumomei.bsky.social

      📰 参考: [cnbc.com] Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack

      tsukumomei.bsky.socialBluesky6d agoview on Bluesky ↗
    all of them →
  5. 3

    FBI blames North Korea's TraderTraitor group for the heist

    CNN first reported North Korean involvement on October 30, and the FBI officially confirmed on October 31 that North Korean state hackers, identified as the group TraderTraitor, stole more than $6 billion from Binance around October 29.

    “FBI officially confirms North Korea was behind the $6.3 BILLION attack on Binance.”
    — @coinbureau
    1. 28 outlets Trump says US looking into Binance hack: ‘We don’t know’ if North Korea responsible

      first by The Hill, 8d ago · also Hindustan Times, CBC, Straits Times, CoinDesk, ABC Australia, Australian Broadcasting Corporation +21

      29 more headlines
    2. 21 outlets FBI links North Korea to theft of $6 billion from Binance

      first by Reuters, 7d ago · also NBC News, Investing.com News, Deutsche Welle EN, Newsweek, Le Monde EN, Al Jazeera +14

      17 more headlines
    22 more claims →

    • 🚨BREAKING: FBI officially confirms North Korea was behind the $6.3 BILLION attack on Binance. The FBI says North Korea was responsible for stealing more than $6 BILLION in crypto from Binance on or around October 29. It blames the same hacking group it calls TraderTraitor,

      @coinbureauX7d ago2.2k▲view on X ↗
    2 more of the top 3 · 73 posts in this stretch
    • mttaggart

      As far as I know, there has been no actual evidence linking the Binance hack to the Cursor Claude extension supply chain attack. The timing is coincidental but otherwise we're in Speculationtown

      mttaggartMastodon8d ago29▲view on Mastodon ↗

    • I see a lot of focus on the "how" this happened, big deal.Computer security is a farce.Let's address the elephant. I find the accused to be very unlikely.20 minutes?! $6.3B?!Their APT groups have been classified as advanced but not elite, this suggests a huge jump for their groups."There will be signs".There should be an influx of purchases right?…

      jas-Hacker News8d agoview on Hacker News ↗
    all of them →
  6. 1 day quiet
  7. 2

    CZ and Binance say user funds are safe

    Binance and former CEO Changpeng Zhao (CZ) said the exchange was investigating a security incident, thanked Tether and Circle for freezing roughly $1.8 billion in stolen stablecoins, and pledged to cover any user losses from the balance sheet.

    “User funds are safe! ... I expect all user funds will be fully covered.”
    — @cz_binance
    1. 27 outlets Bitcoin drops below $77,000 as $6 billion Binance hack rattles crypto market

      first by Nairametrics, 9d ago · also Dexerto, Indian Express, Bloomberg Tech, Barron's, CoinDesk, Yahoo Finance +20

      30 more headlines
    2. 27 outlets Donald Trump Comments on Binance Hack, Says US Is Still Investigating North Korea's Role

      first by Coinpedia Fintech News, 9d ago · also BBC, PCMag, CoinDesk, ITPro, Euronews, The Block +20

      10 more headlines
    23 more claims →

    • JUST IN: 🇰🇵 North Korea responsible for $6 billion Binance hack, CNN reports.

      @WatcherGuruX9d ago28k▲view on X ↗
    2 more of the top 3 · 275 posts in this stretch
    • carlquintanilla.bsky.social

      (WSJ) - Hackers appeared to have plundered at least $1.7 billion Thursday from Binance in what would be the largest-ever cryptocurrency heist. @wsj.com

      carlquintanilla.bsky.socialBluesky9d ago1.8k▲view on Bluesky ↗
    • zackwhittaker@mastodon.social

      Binance said that its $6.3 billion crypto breach "may involve a compromised DevOps engineer’s laptop." If a single employee's laptop was able to access Binance's systems capable of controlling billions of dollars worth of crypto, that's the *company's* fault — not the employee's. https:// this.weekinsecurity.com/that-b…

      zackwhittaker@mastodon.socialMastodon9d ago357▲view on Mastodon ↗
    all of them →
  8. 1

    Binance's hot wallets drained of billions in minutes

    Binance was hit by a hack draining hot wallets of an initial estimated $2 billion that grew to roughly $5.6–6.3 billion across BTC, ETH, USDT, USDC and other assets, in what was later described as a 20-minute operation.

    “BREAKING: World's largest crypto exchange Binance hacked with over $5.6 billion stolen…”
    — @WatcherGuru
    1. 12 outlets Binance Hack: As It Happened on October 29-30

      first by Bitcoin Insider, 9d ago · also The Guardian, Yahoo Finance, Bitcoin News, BBC, Bitquery, International Business Times +5

      16 more headlines
    2. 11 outlets Binance says it has covered 90% of losses from $6.3 billion hack

      first by Channel NewsAsia, 8d ago · also The Independent, TheStreet, CoinGape, Reuters, CNBC, Arab News +4

      12 more headlines
    4 more claims →

Also covered reported alongside — the timeline has no entry for these yet

  1. 5 outlets North Korea Just Pulled Off the Biggest Crypto Heist in History, Draining $6.4 Billion From Binance in 20 Minutes

    first by 24/7 Wall St., 9d ago · also Wired, HN Best, HN Frontpage, NYT

    3 more headlines
  2. 5 outlets Long accused of abetting crypto crimes, Binance has now become a victim

    first by Philadelphia Inquirer, 8d ago · also Yahoo Finance Australia, The Independent, Associated Press, Toronto Star

  3. 4 outlets Crypto worth billions frozen after suspected Binance hack

    first by Mastodon, 7d ago · also The Guardian, Financial Times, BBC

    5 more headlines
  4. 4 outlets Binance hack updates: US Secret Service says it is helping to track funds stolen from crypto firm in $6.3bn hack

    first by BBC, 8d ago · also NY Post, New York Post, The Asia Business Daily

    3 more headlines
  5. 4 outlets Binance Finds ‘Additional Points of Breach’ in $6.3B Hack

    first by Yahoo Finance, 9d ago · also CryptoSlate, The Next Web, Bitcoin Insider

    5 more headlines
  6. 4 outlets Hackers steal €5.6bn in cryptocurrency from Binance

    first by TechCentral.ie, 9d ago · also TechRadar, RTÉ, Futurism

    3 more headlines
  7. 4 outlets Binance working with FBI to recover assets following $6.3B hack

    first by Cointelegraph, 9d ago · also Reuters, Investing.com News, Channel News Asia

    1 more headline
  8. 3 outlets Binance hack: How to spot fake support messages after the $6.3 billion theft

    first by The Oregonian, 4d ago · also PennLive, MassLive

  9. 3 outlets Binance says resuming withdrawals after major hack

    first by Bangkok Post, 7d ago · also The Coin Republic, France 24 EN

    1 more headline
  10. 3 outlets $6.3 billion vanished in minutes. The FBI says it knows who did it.

    first by The Oregonian, 6d ago · also PennLive, MassLive

and 81 smaller pieces

What people are saying 16 voices from 5 sites · best of 471 · verbatim

Still unanswered
  • How did a single compromised engineer's laptop and an internal AI tool allow escalation to control multiple DevOps engineers' credentials?
  • Is North Korea's TraderTraitor group actually capable of executing a $6.3bn theft in 20 minutes given its prior classification as 'advanced but not elite'?