Reported by The Guardian
Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June
The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed.
The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of “hot wallets” where billions of dollars worth of crypto-assets were taken.
More from the original report
The FBI has blamed North Korea for last week’s heist but Pyongyang, a prolific crypto-hacker , described the accusation as “absurd rhetoric” on Tuesday.
According to an update Binance released on Tuesday, the hackers got their first foothold in the summer when a company engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s cryptowallet infrastructure.
A fake project director then contacted a different engineer on a legitimate job-hunting platform, leading to a first-round video interview with a sham HR representative and a second-round interview – on a chat app – with the “chief executive” of a fictitious company. It was during the second interview that the engineer was tricked into downloading malware on to his computer.
On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer’s system and that of a second wallet developer on the same team. Then on 29 October, the attacker used the second developer’s computer, using stolen credentials from the first engineer, and triggered a malicious script to launch the attack.
Binance said $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted.
Deepfake job interviews are a known part of North Korea’s cyber-arsenal , but normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in…