Binance says malicious code, fake job interview led to $6.3B hack

Binance said Tuesday that a $6.3 billion hack of the world’s largest cryptocurrency exchange was the result of a “multi-stage campaign,” including a malicious software download and a fake job interview.

Hackers, whom both the FBI and outside analysts have linked to North Korea, moved billions of dollars’ worth of crypto out of Binance wallets Thursday, prompting crypto companies to freeze about $3 billion in assets.

In a lengthy post on the social platform X, Binance explained that an engineer initially downloaded tampered code to install a popular AI coding tool in June.

While the company’s security team detected the anomaly, replaced the device and updated credentials, the engineer and his colleagues on their wallet infrastructure team were exposed, Binance said.

In September, another engineer was contacted by an individual posing as a project director through a “legitimate job-hunting platform.” They arranged an initial interview with an HR representative and another interview with an individual purporting to be the CEO.

During the second interview, the engineer was instructed to download an assignment containing malicious code onto his work computer, which initiated a series of “unauthorized activities.”

“This was more advanced and deceptive than previously seen social engineering approaches,” Binance noted in Tuesday’s post.

Shortly before the hack, the attacker used the compromised computer to access an internal AI tool and gain control over two other computers, including that of the first engineer.

They logged into a third engineer’s computer on the day of the hack, using credentials obtained from the first engineer, and launched the attack.

Two blockchain intelligence firms quickly connected the hack to TraderTraitor, a North Korean hacking unit that has previously targeted the crypto industry. The FBI said Saturday it was also attributing the attack to North Korea.

North Korea denied involvement Tuesday, with the influential sister of leader Kim Jong Un calling the accusations “a trite provocation.”

“This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” Kim Yo Jong said in a statement, using an abbreviation for the Democratic People’s Republic of Korea.

Binance vowed to cover all losses related to the hack, saying Tuesday it has replenished 98 percent of impacted assets. It also said it has taken “immediate action to contain the incident and strengthen the systems involved.”

“The entry points identified as having been used in the attack have been closed,” the company added. “Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.”