Binance’s $6.3 billion hack began with a fake job interview, the exchange said Tuesday in a media briefing, describing a months-long campaign by North Korea-linked attackers to infiltrate the exchange and carry out the biggest heist in crypto history.
Binance’s Richard Teng told reporters the attack “was a campaign, built over many months” and said the FBI has attributed it to North Korea.
Jimmy Su, Binance’s chief security officer, said a software engineer was contacted in September through a legitimate job platform by someone posing as a project director. A fake HR representative interviewed him by video and shared a social media account with personal photos to build trust. A second interview, with a purported CEO, ended with the engineer being told to download a coding assignment onto his work computer. It contained zero-day malware that evaded endpoint security.
In June, another engineer had installed a tampered Homebrew package while searching for an AI tool. Binance caught and replaced the device, but said the engineer and his colleagues on the company’s wallet team remained exposed.
On Oct. 20, attackers used the machine compromised by the fake interview and an internal AI tool to reach two wallet engineers’ computers, Su said. On Oct. 29, they used stolen credentials to deploy a container and run a malicious script. Funds began leaving at 20:05 UTC.
Leave a Reply