Binance says fake job interviews and malware drove $6.3bn crypto heist
Summary
Binance said on Tuesday, November 3, that the theft of about $6.3 billion in crypto assets was a multi-stage campaign combining fake job interviews, malware and social engineering rather than a single breach. According to the company's postmortem as reported, the operation began in June when a developer downloaded a tampered installer apparently spread through a malicious Google ad. In September, an engineer was contacted through a legitimate job-hunting platform and invited to bogus interviews with fake company representatives. The campaign ended with a raid on hot wallets the week before. Co-CEO Richard Teng said hackers used fake job interviews and an AI tool, and reporting cites an internal AI tool among the methods. Binance said it has replenished 98% of the $6.34 billion in affected assets and will bear the financial cost, and it paused withdrawals for almost two days after the incident. Suspected North Korean attackers were named in reporting based on Binance's account. Reported totals vary across outlets, from $6.3 billion to $6.43 billion.
Timeline
BBC
Source ↗Reports, citing Binance, that an engineer was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives.
The Hacker News
Source ↗Reports that Binance said the $6.43 billion theft was a multi-stage campaign involving a tampered Homebrew installation and a recruitment-themed social engineering attack on two engineers, and that it was not a single isolated breach or simple phishing incident.
Financial Times
Source ↗Reports, based on Binance's internal investigation, that human error played a role in the $6.3bn heist, which used fake interviews and social media profiles.
CNBC
Source ↗Reports that co-CEO Richard Teng said hackers used fake job interviews and an AI tool to steal $6.3 billion, and that Binance has replenished 98% of the $6.34 billion in affected assets according to its security report.
The Guardian
Source ↗Reports that the operation began with an inadvertent download of malware in June, led to a recruitment scam in September and ended with a raid on hot wallets last week, with hackers using bogus job interviews, malicious software and an internal AI tool.
WIRED
Source ↗Reports, citing Binance, that suspected North Korean attackers duped an engineer with a fake job interview and a malicious download to gain a foothold and steal billions.
The Verge
Source ↗Reports, citing a Binance postmortem, that the process started in June when a developer downloaded a tampered installer apparently spread by a malicious Google ad, combining well-known hacking techniques over a few months.
The Japan Times
Source ↗Reports that Binance will bear the financial cost of the hack and that the exchange paused withdrawals for almost two days after the incident.
ABC
Source ↗Reports that Binance has released details showing hackers used fake jobs and malicious code to steal billions in funds in the largest crypto heist.
Engadget
Source ↗Reports that Binance has revealed more details of the cyber attack that resulted in the loss of $6.34 billion in digital assets, which involved fake job interviews.
Ars Technica
Source ↗Reports, citing Binance, that the hackers spent months planning the heist using laptop infections, compromised internal tooling and fake job interviews.
Comments
No comments yet.
to like and comment.