Binance says fake job interviews helped spark $9 billion crypto hack

The company at the centre of a multibillion-dollar cryptocurrency theft said the hack was partly caused by engineers being duped by fake job interviews or downloading malicious software.

Binance, the world’s largest cryptocurrency exchange, had $US6.3 billion ($9 billion) of assets stolen after a cyberattack on Thursday (Friday AEDT).

Initial investigations from the FBI have claimed North Korea is responsible for the theft, and the company released a report on Wednesday, claiming the attackers used social engineering techniques to gain access to Binance’s systems, setting off a chain reaction that allowed the hackers to steal the funds.

Binance insisted the attack was “a sophisticated, multi-stage campaign. It was not a single isolated breach or a simple phishing incident”.

“The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling,” the report said.

It described how in June, an engineer accidentally downloaded malicious software when attempting to install a popular AI coding tool after searching for it on a search engine.

While Binance detected the exposure and quickly shut it down, the engineer’s role and the Binance wallets of some of their colleagues were exposed to the hacker.

In September, another engineer was contacted through a legitimate job-hunting platform by someone posing as a project director.

After arranging a first round interview with a HR representative, a second round interview was conducted on a popular social chat app, where the engineer was instructed to download an “assignment”.

The assignment contained a malicious code repository that was subsequently embedded into their computer that was later used to initiate the cyberattack.

While the report acknowledged these techniques were not new and “reflect the persistent threat posed by state-sponsored actors targeting the cryptocurrency industry”, Binance said the specific methods used were more comprehensive than they had ever seen.

“In the first round, the purported HR representative conducted a live video interview with Software Engineer B. The interviewer shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust,” the report said.

Read more

Criminal investigation after NSW Health hit by cyber breach

“This was more advanced and deceptive than previously seen social engineering approaches.”

The hackers used the malicious software on the engineer’s computer, as well as an internal AI tool to Binance wallets, and allowed the hackers to conduct unauthorised transactions.

Binance said it would absorb the financial impact of the stolen funds and will reimburse affected customers.

“As of this update, approximately $US2.85 billion in digital assets have been frozen or intercepted, subject to reconciliation and market price volatility,” the company said, adding it had overhauled its digital security systems.

Binance said they had previously detected and shutdown 57 suspected North Korea-linked cyber threats.

The FBI on Sunday said the theft was orchestrated by North Korean hackers, attributing the attack to a hacking group known as TraderTraitor, which was also behind a $2.1 billion hack of the Bybit exchange last year.

However, Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un, called the FBI announcement “a trite provocation” and “an absurd rhetoric”.

“This is not the first time that the US has attempted to spread misunderstanding of the DPRK in the international community, blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale,” she said in a statement, using the abbreviation of North Korea’s official name, the Democratic People’s Republic of Korea.

Read more

US midterms LIVE: First polls close; Exit polls show bad news for Republicans; Trump rages as results come in

“On this occasion, we confirmed Washington’s hostile attitude toward the DPRK once again and are closely monitoring a variety of persistent provocations of the US against our state,” Kim Yo-jong said.

Asked by reporters during a Halloween party at his Mar-a-Lago estate in Florida, US President Donald Trump suggested investigators weren’t yet certain that North Korea was involved.

“I’m not concerned. We’re learning about it,” Trump said.

“We don’t know if it’s North Korea,” he added, though saying investigators could still determine that it was.

- Reported with Associated Press