Binance has revealed that hackers used a fake job recruitment process, malware and an internal AI tool to gain access to its systems before stealing $6.3 billion in cryptocurrency in the exchange’s record-breaking breach.
Hackers behind the $6.3 billion (£4.7 billion) theft from cryptocurrency exchange Binance used bogus job interviews, malicious software and an internal artificial intelligence (AI) tool as part of a months-long operation.
The world’s largest cryptocurrency exchange said the attack began in June, when an engineer inadvertently downloaded malware that exposed details about their role and colleagues responsible for Binance’s cryptocurrency wallet infrastructure.
The attackers later targeted another employee through a legitimate job-hunting platform.
A fake project director contacted the engineer and arranged a video interview with a bogus human resources representative.
The employee was then invited to a second interview on a messaging platform with the supposed chief executive of a fictitious company.
During the second interview, the engineer was tricked into downloading malware, giving the attackers another route into Binance’s systems.
On October 20, the attackers used the compromised computer and an internal AI tool to gain control of the engineer’s system and another developer’s computer.
Nine days later, the hackers used stolen credentials from the first engineer to access the second developer’s machine and launch a malicious script.
The operation ultimately targeted so-called hot wallets, which are cryptocurrency wallets connected to the internet and used to process transactions.
Binance said $6.34 billion was drained from its wallets, although $2.85 billion has since been frozen or intercepted.
The crypto exchange said: “This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry.”
The FBI has blamed North Korea for the attack, with investigators linking the incident to the country’s sophisticated cyber operations.
Pyongyang has denied the allegations. Kim Yo-jong, sister of North Korean leader Kim Jong-un, described the claims as “absurd rhetoric”.
She is quoted as saying: “The FBI is trying to brand the DPRK [the Democratic People’s Republic of Korea] as a ‘cybercriminal state’.”
Kim added: “But the US assertion is absurd rhetoric and nothing new.
“It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds.”
Binance hackers used bogus job interviews in $6.3 billion crypto heist
