Hackers used a complex, multi-stage campaign involving compromised tools and fake job interviews to penetrate Binance’s internal systems and steal a record $6.34 billion (£4.72bn) in funds, the company said.
The FBI and other authorities and security researchers have attributed the attack to North Korea.
In June a Binance Wallet DevOps engineer downloaded a compromised version of the Homebrew package manager in order to install a popular AI coding tool, after finding the fake package manager in search results.
Initial compromise
The security team detected the malware and took precautions, but the engineer’s role and those of other colleagues on the wallet infrastructure team had been exposed to the hacker.
In September, a second engineer was contacted through a legitimate job-hunting platform by an individual posing as a project director, via a profile on the platform that made reference to the engineer’s experience at Binance.
The fake project director arranged a first interview with a fake human resources representative, followed by a second interview with a person claiming to be the chief executive of a fictitious company.
During the first interview, the representative used techniques to build trust, such as sharing a social media account with personal photos.
Fake tools
At the end of the second interview, the fake chief executive instructed the engineer to download a supposed assignment that contained a malicious code repository, which executed during the setup process and deployed sophisticated techniques to avoid being detected.
On 20 October, the attack group made use of the compromised computer and used an internal Binance AI tool to gain control over the computer of the first engineer, who had been contacted in June, and that of a third engineer.
On 29 October, the attack group finally logged into the third engineer’s system, used credentials stolen from the Wallet DevOps engineer, and triggered a script to launch the attack.
Social engineering
Binance said it has restored 98 percent of the stolen funds, and is working to improve cyber-security – adding that it has detected and prevented 57 other suspected North Korean attacks this year.
The complexity of the attack mirrors others attributed to North Korea, including previous crypto thefts, as well as scams in which engineers pretending to be based in the United States have obtained remote-working jobs with US companies in order to bring in income as well as to gather intelligence, FBI investigators have said.
Kim Yo Jong, a top North Korean official, said this week that the latest accusations were a “sinister attempt” to damage the country’s image.