Binance says fake job interviews helped attackers steal $6.34 billion in crypto

Binance has disclosed more details about the cyberattack that affected $6.34 billion in digital assets, saying it began months before the theft on October 29. The exchange linked the incident to the FBI’s finding that North Korea was responsible.

In June, a Wallet DevOps engineer working on Binance’s wallet infrastructure downloaded a tampered installation of a popular AI coding tool found through a search engine. Binance detected the anomaly and responded, but said the incident exposed information about the engineer’s colleagues.

In September, another Binance software engineer was contacted through a legitimate job-hunting platform by someone posing as a “Project Director.” After two interview rounds, the supposed company’s CEO sent the engineer an assignment through a chat app. The downloaded file contained malware that ran during setup.

Binance said the malware used obfuscation and evasion methods to avoid detection, including replacing a genuine development-tool component with a malicious version. It also concealed its activity and removed traces of the compromise.

On October 20, attackers used the compromised software engineer’s computer and an internal AI tool to gain control of devices belonging to the Wallet DevOps engineer and another colleague. On October 29, they accessed the third engineer’s computer, used credentials stolen from the Wallet DevOps engineer and ran a malicious script to launch the attack.

Binance said $2.85 billion of the $6.34 billion in affected assets had been frozen. It acknowledged that some assets continued to move after withdrawals were suspended because the transactions had already been authorized.

As of November 3, the exchange said it had rebuilt the affected wallet system and internal AI tools, replaced affected devices, decommissioned compromised credentials and tokens, and completed enhanced security scans on employee devices. It also added AI-powered anomaly detection.

Binance said it would absorb the financial losses and had set aside enough to cover the stolen funds. It said it had replenished 98 percent of the affected token assets and was working to purchase the remaining, less liquid assets.

Sources: Engadget.