Binance reveals hackers the FBI links to North Korea used fake job interviews to pull off $6.3bn crypto heist
The theft, traced to a compromised engineer's laptop, has been formally attributed by the FBI to TraderTraitor, believed to be part of North Korea's Lazarus Group.
North Korean hackers spent months laying the groundwork for the record-breaking theft, beginning with a poisoned AI coding tool downloaded by an engineer in June and culminating in a four-hour wallet drain on 29 October. Binance confirmed a rogue internal AI tool was then weaponised to pivot across engineers' computers, allowing attackers to seize deployment credentials and empty billions in minutes.
Kim Yo Jong, sister of Kim Jong Un, dismissed the FBI's accusation as 'a trite provocation' and 'absurd rhetoric.'
Chinese money-laundering crews moved in within 20 minutes of the theft, deploying around 12,000 digital wallets — a fresh wallet created every 25 seconds — to launder the unfrozen $3.3bn.
Spooked customers withdrew $7.42bn after withdrawals resumed on Sunday, though Binance says that is just 3% of its $157bn total assets.