Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June
The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed.
The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September, and then a raid last week of “hot wallets” where billions of dollars worth of crypto assets were taken.
The FBI has blamed North Korea for last week’s heist but the rogue state, a prolific crypto hacker, described the accusation as “absurd rhetoric” on Tuesday.
According to an update released by Binance on Tuesday, the hackers got their first foothold in the summer when a Binance engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s crypto wallet infrastructure.
A different engineer was then contacted on a legitimate job hunting platform by a fake project director, leading to a first-round video interview with a sham HR representative and then a second-round interview – on a chat app – with the “CEO” of a fictitious company. It was during the second interview that the engineer was tricked into downloading malware on to his computer.
On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer’s system and that of a second wallet developer on that team. Then on 29 October, the attacker used the second developer’s computer, using stolen credentials from the first engineer, and triggered a malicious script to launch the attack.
Binance said $2.85bn of the $6.34bn drained from crypto wallets in the attack had been frozen or intercepted.
Deepfake job interviews are a known part of North Korea’s cyber arsenal, but normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the update.
The FBI said on Saturday that North Korea was responsible for the hack.
But Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un, said on Tuesday that the allegations proved Washington remained hostile towards Pyongyang, according to North Korea’s state news agency KCNA.
“The FBI is trying to brand the DPRK [the Democratic People’s Republic of Korea] as a ‘cybercriminal state,’ claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” KCNA quoted her as saying.
“But the US assertion is absurd rhetoric and nothing new,” said Kim, a ruling party official.
“It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds.”
