Binance says fake job interview helped North Korean hackers steal $6.3 billion in crypto
Nextgov/FCW - All Content ·
A coding assignment gave attackers access to an engineer’s work computer. They later used an internal AI tool to reach the team responsible for Binance’s digital wallets.
A Binance software engineer who thought he was interviewing for a new job downloaded a coding assignment that gave hackers access to his work computer, the cryptocurrency exchange said Tuesday in a detailed account of how attackers stole a record $6.3 billion from its digital wallets last week.
The FBI attributed the Oct. 29 theft to North Korea over the weekend. The bureau has asked cryptocurrency firms to block transactions involving the stolen funds. The DPRK has denied involvement, South Korean news agency Yonhap reported Monday , citing state media.
Binance traced the campaign back to June, when a member of its team downloaded a tampered software installer while trying to set up an AI coding tool.
The company caught the intrusion, replaced the computer and changed the employee’s credentials. But by then, the intruders had learned who worked on the systems that manage Binance’s wallets.
In September, someone posing as a recruiter approached a different Binance engineer through a legitimate job site. The engineer sat for two interviews, including one with the supposed CEO. Near the end of that conversation, he was asked to download an assignment laced with malicious code that ran as he set it up on his work computer and escaped detection by Binance’s security software.
On Oct. 20, the hackers used that computer and an internal Binance AI tool to gain control of two wallet engineers’ computers. Nine days later, they used one engineer’s credentials on the other’s machine to reach the service that approves transfers. The moves allowed them to move funds without going through the exchange’s normal withdrawal process, the company said.
“In a world where quiet quitting exists, it should come as no surprise that employees are interviewing on company time,” said Tyler Reguly, the associate director of security R&D at cybersecurity company Fortra. “Organizations need to counter this with adequate controls in place. Particularly, controls around what can be downloaded and executed on a corporate laptop, as well as the permissions granted to the user.”
Binance said about $2.85 billion in stolen assets had been frozen or intercepted. Separately, the exchange said it would cover customer losses and had already replaced 98% of the affected assets as of Oct. 31.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said.
North Korean operatives have long posed as job seekers to pilfer funds for Pyongyang’s regime and weapons programs.
Earlier this year, the U.S. intelligence community assessed that Pyongyang has been able to net at least $1 billion annually in cryptocurrency heists and other financial crimes to fund its weapons development.
In a separate operation the FBI disrupted this fall, operatives used laptops stationed in the U.S. to make it appear they were working there. Such arrangements help them land remote jobs and collect paychecks from American companies while gaining access to their networks.
It’s expected the stolen assets will be used for broader money laundering activities.
“They have too much money for their trusted laundering venues to handle. So the money will flow to a wider network of services, like bridges, instant exchanges, and swappers due to a wider set of money launderers,” said Jonathan Levin, CEO and co-founder of blockchain analysis firm Chainalysis.
Crypto bridges let users move funds from one blockchain to another, while instant swap services let them trade one cryptocurrency for another. Hackers can use both to make stolen funds harder to trace.
“Our investigators are tracking novel automated laundering mechanisms using our new AI capabilities that match the attempted speed and sophistication of the launderers,” Levin added.