Cryptocurrency exchange Binance says North Korean operatives used a fabricated job interview to talk one of its employees into installing malware on their machine — a foothold that, according to the company's account, eventually reached its wallet infrastructure and ended with roughly $6.34 billion in digital assets stolen. That loss figure is Binance's own estimate: it has not been independently verified, and no outside party has confirmed the amount or the ultimate disposition of the funds. Binance puts the incident among the largest crypto thefts it has ever disclosed.
The account, reported by BleepingComputer, describes an intrusion that began without an exploit. Posing as a job candidate, the operators — as Binance describes the sequence — pulled a staff member into what appeared to be an ordinary interview process, then persuaded them to run malicious software. That single execution became the bridge between a routine workstation and the systems that custody and move customer funds.
A résumé as the delivery vector
What Binance describes is a textbook social-engineering sequence: identify someone with legitimate access, construct a pretext credible enough to earn cooperation, deliver the payload through an unremarkable-seeming action, then move quietly toward the assets that matter. Everything before the malware installation is persuasion; everything after it is compromise.
Equally unclear in the material cited: how the assets were cashed out or laundered, how many operators were involved, whether any portion has been traced or frozen, and what remediation steps Binance has taken. Whether customer balances were affected, and whether the malware has been fully evicted, also remain open questions. The attribution to North Korea rests on Binance's assessment; no independent party has publicly confirmed it.
The control that failed was behavioural
For defenders, the uncomfortable part is that no cryptographic or network control was defeated. Perimeters, patch regimes and hardware security modules assume an attacker must break something. No control was broken; the attacker was invited in and asked to run a file.
Interview and onboarding steps are an especially attractive vector because they are high-frequency, low-scrutiny interactions. Candidates expect to install tooling, share screens or complete take-home tasks — and the person on the receiving end is being evaluated too, which discourages the hesitation that might otherwise prompt a second look. North Korea-linked groups have pursued crypto firms through this blend of pretext and patience for years; the novelty here is the outcome attached to it.
The technique is not exchange-specific. For Hong Kong IT teams — exchanges, Web3 startups, or any shop running take-home coding tasks and video interviews — the exposure is identical. The relevant question is not whether a local firm uses the same recruitment rituals, but whether one compromised workstation can reach the systems that matter.
Binance's framing shifts attention away from exploit code and toward the human interface attackers keep finding easiest to open: an employee, a job opportunity, and a file that needed to be run.
Source: BleepingComputer.
加密貨幣交易所幣安（Binance）表示，朝鮮特工利用一場偽造的求職面試，游說其中一名員工在其電腦上安裝惡意軟件——根據該公司的說法，這個立足點最終觸及其錢包基礎設施，並導致約63.4億美元數字資產被盜。該損失數字為幣安自行估算：尚未經獨立核實，亦無外部機構確認有關金額或資金的最終去向。幣安將此事件列為其歷來披露的最大規模加密貨幣盜竊案之一。
BleepingComputer 報道的這宗事件，描述了一次並非利用漏洞（exploit）展開的入侵。據幣安對事件過程的描述，行動人員假扮求職者，將一名員工引入看似尋常的面試流程，隨後說服其執行惡意軟件。這一次執行，成為了普通工作站與託管及轉移客戶資金系統之間的橋樑。
以履歷表作為投放載體
幣安所描述的，是一套教科書式的社會工程學流程：找出擁有合法權限的人員、構建足以取得合作的可信藉口、透過一個看似無可厚非的操作投放惡意載荷（payload），然後悄然移向真正重要的資產。惡意軟件安裝之前的一切都是說服；安裝之後的一切都是入侵。
所引用資料中同樣不明朗的包括：資產如何套現或洗錢、涉及多少名行動人員、是否有部分資產已被追蹤或凍結，以及幣安採取了哪些補救措施。客戶餘額是否受影響，以及惡意軟件是否已被徹底清除，仍是未解之問。將事件歸因於朝鮮，依據的是幣安的評估；目前無獨立機構公開證實。
失效的是行為層面的控制
對防禦方而言，令人不安之處在於：是次事件並未攻破任何密碼學或網絡防護機制。邊界防護、補丁管理規章以及硬件安全模組（hardware security module），都基於攻擊者必須先突破某種防護的假設。今次沒有任何防護被攻破——攻擊者是被邀請入內、並被要求執行一個檔案。
面試及入職流程之所以成為特別吸引的攻擊載體，在於這些互動頻率高、審查卻相對寬鬆。求職者預期需要安裝工具、共享螢幕或完成帶回家的測試任務（take-home task）——而接收方當時亦正在接受評估，這種情境會抑制猶豫心理，令人不會多作一步審視。朝鮮相關黑客組織多年來一直以這種藉口與耐心並用的手法追蹤加密貨幣企業；今次的「新意」在於其所帶來的結果。
這種手法並非交易所專有。對香港 IT 團隊而言——無論是交易所、Web3 創業公司，還是任何進行帶回家編碼任務及視像面試的機構——所面對的風險完全相同。相關問題並非本地企業是否採用同樣的招聘慣例，而是單一部被入侵的工作站，能否觸及真正重要的系統。
幣安的敘事框架，將注意力從漏洞代碼移開，轉向攻擊者始終認為最容易撬開的人性介面：一名員工、一個工作機會，以及一個需要被執行的檔案。
來源：BleepingComputer。