Binance Hackers Used Fake Job Interviews in $6.3 Billion Heist

Binance Holdings Ltd. said Tuesday that the hackers behind a $6.3 billion heist used social engineering techniques including fake job interviews, as well as malicious software, in the most detailed report yet on how the incident unfolded.

Binance, which attributed the hack to North Korea, said the breach involved a “sophisticated, multi-stage campaign.” One of the company’s engineers was contacted through a job hunting platform by someone posing as a project director, the exchange said in the report published Tuesday. They were then interviewed by a person claiming to be the chief executive officer of a fictitious company over a social chat app, and asked to download an assignment containing a “malicious code repository”. This then set off a series of unauthorized activities, the report said.

“This was not a single mistake or a single breach. It was a campaign built over many months,” said Richard Teng, co-chief executive officer of Binance. The attackers “combined fake recruitment interviews, malicious software disguised as legitimate developer tools, compromised devices, and AI techniques.”

In the hours after the hack — first reported on Oct. 29 — Binance initially said that the attackers may have compromised a software engineer’s laptop, which allowed thieves to withdraw crypto from the exchange. In a subsequent post, the exchange said that the attack was “complex” and the company had “uncovered additional points of breach,” without providing more details.

The newest disclosure on how hackers managed to siphon billions from Binance comes as the crypto exchange — and the crypto industry — attempts to recover from the largest hack in the history of digital assets.

The theft deepened a mounting security crisis for an industry already grappling with a wave of cyberattacks. Artificial intelligence is adding to the threat, giving criminals new tools to find weaknesses and deceive employees, and raising the stakes for platforms safeguarding billions of dollars in digital assets.

Shortly after the Binance exploit, traders, cybersecurity professionals, and token issuers all rushed to respond to the fallout. Stablecoin giants Tether and Circle Internet Group Inc., as well as other entities, quickly froze — or stopped hackers from moving — almost $3 billion in funds. Analytics firm raced to track the flow of crypto, eventually attributing the exploit to North Korea — a charge the country has denied. Some traders capitalized on the market turbulence.

Throughout the ordeal, Binance has sought to reassure its users, saying that it will bear the financial cost. Still, the exchange paused withdrawals for almost two days after the incident. Early on Sunday, Binance began to progressively let users take out funds. The company initially saw billions in outflows, but the situation appears to have stabilized and by Tuesday it reported that hourly deposits had started exceeding hourly withdrawals.

Binance has also said that it has almost replenished the cryptocurrency that the hackers had stolen, using a combination of money from its corporate treasury as well as two insurance funds.

The crypto exchange is also working with U.S. law enforcement, including the Federal Bureau of Investigation, the U.S. Secret Service, and the Justice Department. The FBI, which stepped in soon after the hack in Binance’s aid, has also attributed the breach to North Korean hackers.

Despite the history-making hack, the market fallout has remained muted. Initially, Bitcoin fell more than 4% after the exploit to nearly $76,000, but the world’s largest cryptocurrency has since regained some of its losses, trading at $77,400 on Tuesday.

Top photo: The Binance logo on a laptop arranged in the Brooklyn borough of New York, on Wednesday, June 7, 2023. Photographer: Gabby Jones/Bloomberg.