North Korean fake job interview led to $6.3B Binance heist

Posted by smalltech 4 days ago

North Korean fake job interview led to $6.3B Binance heist(www.theregister.com)

656 points | 384 commentspage 9

mike_bob 4 days ago|

Guy probably skipped his "mandatory" KnowBe4 training... see HR actually does serve a purpose! /s

CurbStomper5 3 days ago||

[dead]

tehjoker 4 days ago||

There is no evidence given that North Korea did this.

"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. TRM will share further findings as the investigation develops."

https://www.trmlabs.com/resources/blog/north-korea-steals-us...

This is simply an assertion that an official enemy did something we don't like. It could just as well be a CIA money laundering scheme. This would make more sense, given the wider deployment of US cyber weapons and assets as well as the desire of North Korea not to provoke American aggression which previously murdered about 20% of their population.

It is widely known America has cyberweapons deployed around the globe. It is likely trivial for them to fake a trail of evidence from the DPRK.

gadders 4 days ago||

I think we need to implement a new handshake protocol for job interviews.

Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.

https://www.youtube.com/watch?v=g7v2clX8ynE

lexarflash8g 3 days ago|

It seems like these North Korean IT guys are actually pretty tech savvy and can actually do the job and work -- but they are doing recon at the same time with malicious intentions. An unskilled scammer would get caught every time and couldn't do the work.

I mean it would make sense to hire these NK guys to consult DevSec teams if it wasn't for the travel restrictions in NK -- sort of like how reformed black-hat hackers get legit jobs in the IT sec industry.

CommanderData 4 days ago|

It's strange companies haven't cracked something as basic as remote hiring checks yet.

There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..

lbriner 4 days ago|

Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.

Unfortunately:

1) The dev downloaded it onto a work laptop which was really poor behaviour

2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.

3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.

But it is easy to be wise in hindsight.

CommanderData 4 days ago||

It seems in this case really poor behaviour and practices, I can imagine some security engineer shouting I told you so pretty loudly.

On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).

I do miss seeing someone's camera feed break or AI tool break down mid interview.