Binance’s $6.3 billion cyberattack began with fake job offers: Co-CEO Richard Teng reveals details
Binance Holdings has revealed that hackers who stole $6.3 billion from the company used techniques of social engineering, which included fake job interviews and malware as they published a report on the massive heist that took place recently.
Binance has attributed the theft to North Korea, saying that the breach involved a “sophisticated, multi-stage campaign.”
It said one of its engineers was contacted through a platform for hunting jobs by someone who claimed to be a project director.
During the course of his assessment, he was asked to download an assignment that had a “malicious code repository,” which then set off the unauthorised activities, the company said.
“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance. The attackers “combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques," he added.
He also spoke to CNBC, and told the outlet that the attackers had “spent months building their way in.”
Explaining how the engineer was trapped, he said, “In June, [the attackers] set up a fake version of a developer tool and lured one of our engineers to install that,” adding, “In September they posed as recruiters and ran a series of job interviews with another engineer, and that ended up in a coding exercise that contained hidden malware designed to evade security ... from there they moved violently through our internal AI tools and obtain[ed] access that breach[ed] the system that authorized our wallet transaction.”
The security report that Binance published on Tuesday said that preparations for the attack began in June when one of their engineers downloaded an installation of Homebrew that was tampered with “to install a popular AI coding tool after searching for it on a search engine.”
The company revealed that this suspicious activity was detected, following which the engineer's device was replaced by the company, but by then his “role and his related colleagues on our wallet infrastructure team was exposed to the hacker.”
Binance however said that it has managed to rebuild the wallet system and the internal AI tool which were affected in the attack. It has also replaced the devices that were compromised. Tokens and credentials associated with the affected engineers were decommissioned.
“We’re also getting an independent expert to review everything that we have done, and we’ll keep strengthening our defenses as the investigation continues,” Teng told CNBC, adding, “We’re working around the clock with law enforcement agencies and with industry partners to trace and freeze the stolen funds for that front.”
With agency inputs
Catch all the Business News , Corporate news , Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.
✕
Wait for it…
Oops! Looks like you have exceeded the limit to bookmark the image. Remove some to bookmark this image.