- Hackers linked to North Korea stole $6.3 billion from Binance using a fake LinkedIn job interview.
- The heist is the largest cryptocurrency theft in history, and experts say the proceeds could fund North Korean weapons programs.
- Chinese money launderers are believed to have shuffled the stolen funds through about 12,000 digital wallets.
- Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the FBI’s accusation as a trite provocation and blamed U.S. hostility.
- President Trump cast doubt on North Korea’s involvement despite the FBI’s attribution.
In what reads like a spy thriller scripted for the digital age, hackers the FBI has tied to North Korea turned a simple LinkedIn job interview into the largest cryptocurrency theft in history last week, stealing $6.3 billion from Binance by tricking a company engineer into downloading malware disguised as a job assignment.
The heist has erupted into an international showdown, with Kim Yo Jong, the powerful sister of North Korean leader Kim Jong Un, calling the FBI’s attribution of the attack to her country “a trite provocation” and dismissing it as another chapter in Washington’s long-running hostility toward Pyongyang. Even President Donald Trump has poured cold water on the tidy narrative, telling reporters he isn’t sure North Korea was responsible.
Hackers posed as recruiters to trick Binance engineer
According to Binance’s own investigation, a company software engineer received a professional message on LinkedIn from someone claiming to be a project director at another firm. The conversation led to a first-round interview with a supposed HR representative, then a second-round chat with someone posing as a CEO of a company that didn’t actually exist. The “assignment” he downloaded gave hackers a backdoor into Binance’s systems.
But that wasn’t the only entry point. In a parallel operation, a separate engineer clicked on an online ad for a doctored copy of Homebrew, a widely used software tool. Binance caught and deleted the malicious download, but not before the hackers had already scooped up key details about the engineer’s job and the colleagues who managed the company’s digital wallets.
AI tools turned against Binance itself
Once inside, the attackers showed they had done their homework. Using the compromised engineer’s laptop, they accessed Binance’s own internal artificial intelligence tools to gain control over two additional engineers who managed the company’s cryptocurrency wallets. One of those engineers had a “container deployment permission token” sitting on his computer.
The loot moved with breathtaking speed. Most of the stolen funds zipped across 10 blockchains in about 20 minutes, according to blockchain intelligence firm TRM Labs. The stablecoin issuers Tether and Circle nevertheless managed to freeze billions, but the New York Post reports that around $3.3 billion remains unfrozen.
Chinese money launderers turn crypto into cash
After the initial heist, Chinese money laundering crews are believed to have taken over. Blockchain analytics firm Elliptic reports the laundering operation used roughly 12,000 digital wallets in its first three and a half days, opening one every 25 seconds, to shuffle the funds. Experts say this network of brokers and middlemen helps turn stolen crypto into Chinese yuan, which can then purchase the missile components and weapons technology that sustain Kim Jong Un’s nuclear ambitions.
The $6.3 billion figure is roughly double North Korea’s entire recorded merchandise trade from last year and more than a third of its estimated GDP. Stealing crypto gives Pyongyang a sort of “international slush fund,” according to Geoff White, author of “The Lazarus Heist.” Nick Carlsen, a former FBI analyst now at TRM Labs, said “these massive inflows of hard currency go to the regime,” whose top priorities lately are weapons development and internal improvements.
Trump casts doubt as Kim Yo Jong fires back
While the FBI has blamed the heist on a North Korean hacking group known as TraderTraitor, the same outfit linked to a $1.5 billion Bybit hack last year, Pyongyang isn’t taking the accusation lying down. In a Wednesday statement, Kim Yo Jong said Pyongyang views the hacking case as an extension of Washington’s “invariable hostile policy” toward North Korea, accusing the U.S. of trying to squeeze political and strategic profit from the incident.
Complicating matters further, Trump told reporters at his Mar-a-Lago Halloween party, “We don’t know if it’s North Korea,” although he allowed that investigators could still determine it was.
For now, Binance says it has restored 98% of the stolen coins using reserves and other sources and has promised that all customer funds remain safe. But with billions still on the loose, the question remains whether the real story is about North Korean ingenuity, American overreach, or something in between.
Sources for this article include:
Please contact us for more information.
