Finance1 min read

A Binance engineer thought he was interviewing for a job. Then the hackers pounced

By · Via NPR · Published by Everything Blog

In short

The devastating heist took place over roughly 20 minutes following months of preliminary reconnaissance by the attackers, who had previously probed Binance's network in June. Threat actors gained access after convincing an employee to download a compromised file onto a company laptop during a staged job interview on a chat application. Binance has replaced most of the affected customer funds from its own reserves while launching broader security interventions. The FBI attributed the attack to TraderTraitor, a hacking collective linked to the North Korean military.

Key points

  • Binance replaced most of the stolen customer cryptocurrency using its own corporate funds…: Binance replaced most of the stolen customer cryptocurrency using its own corporate funds following the incident.
  • Attackers successfully compromised the internal network by delivering malware hidden insi…: Attackers successfully compromised the internal network by delivering malware hidden inside a fake recruitment assignment.
  • The cryptocurrency exchange has initiated an independent cybersecurity review to prevent…: The cryptocurrency exchange has initiated an independent cybersecurity review to prevent similar intrusion vectors in the future.

Sources checked by our analysis pipeline: 1

The massive $6.3 billion cyber heist suffered by crypto exchange Binance last week may have taken place in only about twenty minutes — but the attacks were months in the making.

That's according an initial assessment released by Binance on Tuesday about how it suffered the world's biggest-ever cyber heist by hackers the FBI has identified as being a North Korean state-sponsored unit.

Those findings show the hackers first tried testing and penetrating Binance's security systems back in June, though the crypto exchange was able to detect that attempt and stop it.

Though unsuccessful, that attempt allowed the hackers — identified by the FBI as a North Korean military unit called TraderTraitor — to learn more about Binance and its systems.

Then, the hackers tried again. In September, a Binance engineer was contacted in a job-hunting platform by a person posing as a "project director" from a company that turned out to be fictious.

The engineer then conducted a first-round interview with a supposed HR representative from the fake company. The hackers used this interview to "build trust," with the…

Finance