How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor
In a multi-stage supply-chain and social-engineering campaign spanning June through October 2026, North Korea-linked threat actors stole $6.43 billion from Binance—the largest cryptocurrency theft on record. Attackers first compromised a Wallet DevOps engineer via a trojanized Homebrew AI-tool installer, exposing team and infrastructure metadata. A second engineer was then targeted through a fake recruitment interview on a legitimate job platform, leading to the delivery of a malicious code repository. The attacker leveraged a compromised internal AI tool to pivot across engineer endpoints, steal a container-deployment token, and ultimately abuse Binance's internal wallet signing service to initiate unauthorized transactions outside normal withdrawal controls. This incident illustrates a dangerous convergence of AI-tool supply-chain poisoning, identity-pivoting through internal automation, and recruitment-themed social engineering—tactics now central to North Korean APT playbooks. As AI tooling becomes ubiquitous in developer workflows, the attack surface for similar campaigns is expanding rapidly across the financial services and Web3 sectors.
Kill Chain
