Job Interview for $6.3 Billion: Binance Reveals How Hackers Infiltrated Its Systems
According to the cryptocurrency exchange, attackers impersonated recruiters and persuaded an employee to complete a malware-infected test task. The access obtained became the starting point of a hacking chain that culminated in the theft of cryptocurrency.
Binance has disclosed details of the attack that resulted in the theft of $6.3 billion in cryptocurrency last week. According to the company, hackers from North Korea used fake recruiter profiles and a job offer to penetrate the corporate network.
The target was an engineer working on cryptocurrency wallets. After two interviews with representatives of the alleged employer, he received a programming test task. The downloaded materials contained malicious code that compromised his work laptop. Binance stated that the company's protective measures did not detect the infection.
The attackers then gained access to an internal tool that allowed them to control the work computers of two other engineers on the wallet team.
This chain also utilized data stolen earlier. A few months before the attack, one employee downloaded a counterfeit application found via a search engine. It contained password-stealing software. Binance replaced the infected laptop, but the attackers used the stolen credentials to further infiltrate the system.
Eventually, they reached the computer of an engineer who had access to systems managing billions of dollars in cryptocurrency assets.
Binance acknowledged that the attack should not have happened and reported strengthening its defenses. The company also plans to engage external specialists for an investigation. The exchange has reported at least 57 alleged attack attempts by North Korea.
The FBI and blockchain analysis experts have linked the theft to North Korean hackers. Security researchers have been warning about such schemes for several years: attackers may spend months impersonating recruiters, investors, or potential partners before asking the victim to open an infected file.
Binance's case shows that the danger lies not only in the persuasiveness of a fake job offer. A critical role was played by the chain of access between work computers and the possibility of reusing previously stolen credentials.
