North Korean Hackers Spent Months Infiltrating Binance via AI Tooling and Fake Interviews

Binance has disclosed that the largest cryptocurrency theft ever attempted — targeting $6.34 billion from its wallets — was the product of a months-long operation by North Korean threat actors. The exchange froze or intercepted $2.85 billion of the stolen assets and confirmed it holds reserves to cover the remainder.

Supply-chain and social-engineering chain

Investigators traced the initial compromise to June, when an engineer downloaded a trojanized Homebrew package. The malware mapped the engineer's role within the wallet infrastructure team. In September, a second engineer was lured through a legitimate hiring platform into a fabricated interview process; a malicious code repository delivered during a technical assignment executed a zero-day payload that evaded endpoint detection.

Critically, the attackers also subverted internal AI tooling used by Binance engineers, turning trusted automation into a reconnaissance and lateral-movement channel. This highlights how GPU-accelerated ML pipelines and developer workstations can become high-value targets when supply-chain integrity and identity verification are insufficient.

Why it matters for GPU / AI infrastructure: the same tooling that accelerates model training — container registries, feature stores, automated CI/CD — can be weaponized if compromised. Operators must harden software supply chains, enforce hardware-rooted attestation for developer endpoints, and treat internal AI services as critical infrastructure.