Summary
Overview
This episode investigates how North Korean hackers pulled off the largest heist in history, stealing $6.3 billion from cryptocurrency exchange Binance in just 20 minutes. The episode explores the sophisticated multi-month operation involving fake job interviews, malware deployment, and rapid automated money laundering, while revealing how North Korea's intelligence services function more like state-sanctioned crime syndicates than traditional spy agencies, using stolen crypto to fund their nuclear weapons and missile programs.
The Anatomy of the $6.3 Billion Crypto Heist
In October 2024, massive amounts of cryptocurrency began flowing out of Binance's hot wallets at alarming speed. The company scrambled to respond with a dispersed war room spanning Abu Dhabi to Hong Kong, watching helplessly as billions disappeared in real-time. The hackers moved money through approximately 12,000 wallets across 11 blockchains in 40,000 transactions, executing a transfer every 25 seconds. While Binance managed to freeze about half the stolen funds by reaching out to other exchanges, at least $3 billion escaped into decentralized exchanges where it couldn't be stopped.
- The heist occurred just after 8pm London time on October 29th, with money rapidly moving out of Binance hot wallets
- Binance set up a war room with 100 people across multiple locations conducting the response via video conference
- Hackers used approximately 12,000 wallets across 11 blockchains and executed 40,000 transactions to shuffle funds
- Money was moved through the system every 25 seconds, likely using AI automation to outpace freezing efforts
- About half the stolen money was frozen, but at least $3 billion escaped to decentralized exchanges
" It is like watching on CCTV as robbers are taking bags of money out of your vault of your bank, Willie Sutton style. "
" They shuffled money in and out of wallets at an amazing speed which suggests automation. "
The Social Engineering Attack: Fake Job Interviews as Weapons
The operation began months before the heist with careful reconnaissance. In June, an engineer downloaded compromised software, which Binance detected and remediated. But the hackers had identified their target. In September, they executed a brilliant social engineering attack, contacting a different Binance engineer through a legitimate job hunting platform and conducting what appeared to be a normal two-round interview process, complete with an HR representative and fake CEO, before delivering malicious code disguised as a job assignment.
- Initial compromise occurred in June when a Binance wallet engineer downloaded tampered software
- Binance security team spotted the June incident and replaced the laptop and passwords, but hackers had already identified their target
- A second engineer was contacted through a legitimate job platform in September for a fake interview
- The fake interview included a first round with HR and video call, then a second round with a supposed CEO via chat app
- Near the end of the interview, the engineer was instructed to download an assignment containing high-end malicious code
" Why just steal one wallet when you can get keys to the vault? "
" The hackers used that compromised computer from the job interview person, plus an internal tool, an AI tool inside Binance, to reach the computer of the first engineer. "
📚 4 more sections below
Sign up to unlock the complete summary with all insights, key points, and quotes
Get this summary + all future The Rest Is Classified episodes in your inbox
100% Free • Unsubscribe Anytime
Sign up now and we'll send you the complete summary of this episode, plus get notified when new The Rest Is Classified episodes are released—delivered straight to your inbox within minutes.