Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’
Hackers behind the $6.3bn Binance heist used bogus job interviews, malicious software and an internal AI tool to compromise the world's largest cryptocurrency exchange.
The operation began in June when a company engineer inadvertently downloaded malware, exposing their role in the team managing Binance's cryptowallet infrastructure. A fake project director then contacted a different engineer on a legitimate job platform, leading to interviews with sham representatives.
During the second interview with a fictitious company's 'chief executive,' the engineer was tricked into downloading additional malware. On October 20, the attacker used the compromised computer and an internal AI tool to gain control of the engineer's system and a second wallet developer's computer.
Attack Execution
On October 29, the attacker used the second developer's computer with stolen credentials from the first engineer to trigger a malicious script, launching the attack that drained $6.34bn from cryptowallets. Binance reported $2.85bn of the stolen funds had been frozen or intercepted.
This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.
North Korean Denial
The FBI blamed North Korea for the heist, but Pyongyang denied responsibility through Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un. She described the accusations as 'absurd rhetoric' and a 'grave political provocation' against her country.
The FBI's claim that a hacking organization 'supported' by North Korea was involved was rejected as misleading international public opinion about cybercrimes worldwide.
Related
