Binance hackers used fake job interview, tampered software in $6.3bn attack - Nikkei Asia
Hackers compromised Binance software engineers through a fake job interview and tampered software to steal $6.3 billion worth of cryptocurrency in last week's record heist, the exchange revealed on Tuesday.
In its initial report on how hackers pulled off what could be the largest-ever financial theft, Binance detailed a multistage hacking endeavor that began in June and culminated in the theft on Oct. 29. Even as Binance scrambled to lock down its system and freeze withdrawals after detecting the attack late on Oct. 29, the hackers were still making off with crypto from the exchange nearly four hours after the first theft.
Sophisticated Breach
Binance said the attack began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with. The exchange detected this afterwards, replaced the device and changed credentials, but the employee's role and those of others on the wallet team were exposed.
A person familiar with the incident said the tool's malicious version had been placed in an advertisement, which meant it appeared higher in a search engine than the real version. Then in September, a second software engineer downloaded a "malicious code repository" onto their computer after interviewing for what they thought was a legitimate role, including meeting virtually with the CEO of a fictitious company.
Execution of Theft
On Oct. 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer's system and that of a second wallet developer. Nine days later, the attacker used the second wallet developer's computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry.
Response and Aftermath
The attack unfolded quickly on Oct. 29, removing 233.46 million XRP from five Binance hot wallets to an attacker-controlled address in just four minutes, before attackers withdrew other cryptocurrencies including bitcoin. Binance received an internal alert about large transfers and began investigating, moving to suspend withdrawals and freeze affected tokens, resulting in about $2.85 billion of frozen assets.
The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance has said it is repaying all customers whose funds were stolen. As a result of the hack, Binance is increasing investment in AI-enabled detection and working on establishing a security research fund and targeted initiatives with leading AI companies.
Related
