Binance CSO unwittingly foreshadowed $6.3B hack tactic months before attack
Months before losing $6.3 billion to a hack, Binance's chief security officer warned about fake job interviews as an attack vector, closely resembling the method used against the exchange.
During a July interview with Cointelegraph, Su explained how attackers could create fake job opportunities tailored to employees, convincing them to run code as part of a technical assessment. "Once that gets executed, the device is compromised and then they can start harvesting credentials," he said, adding that attackers could use this to penetrate further into the network.
Su's warning took on new significance following the September incident where a Binance software engineer downloaded a malicious coding assignment during a fake job interview. This compromise became part of the multistage attack that culminated in October's record-breaking theft.
Detection Challenges
Su had anticipated why security tools might miss such traps, explaining that technical assessments could involve seemingly legitimate steps like downloading code from GitHub. "Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it," he said.
Each step is actually legitimate on its own. So a lot of the anti-virus tools may not be able to detect it and flag it.
Binance's investigation later confirmed similar detection failures, noting the malware evaded endpoint security through obfuscation techniques.
Employee Responsibility
Su emphasized that Binance bears responsibility for containing risks when employees pursue outside opportunities on work devices. "The onus is on us to detect it," he said, "and to stop the actual execution of that code."
The exchange had been conducting monthly phishing simulations for three to four years, with remedial training for employees who failed. "In the beginning, the security hygiene left a lot to be desired. But after this amount of time, the company has improved significantly," Su noted.
Industry Response
Kevin Gibson of recruitment firm Proof of Search told Cointelegraph that the threat is changing how crypto employers assess candidates, with clients increasingly wanting to know if they've met prospects in person. "In crypto, a dodgy job offer or a 'quick catch-up call' can be the first step in a multimillion-dollar hit," he warned.
Binance reported blocking 57 suspected North Korea-linked cyber threats so far this year, roughly one every five days. Following the attack, the exchange tightened device controls, rebuilt affected wallet systems, and increased investment in endpoint protection.
Related
