Cryptoupdated 33m ago2 min read
Binance Says Fake Job Interviews Helped North Korean Hackers Steal Over $6 Billion
20outlets comparedWhere the coverage agrees
7 Western Mainstream5 Other5 Western Alternative3 Other source typesThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Hackers used fake job interviews and compromised internal AI tool to access Binance wallets. The theft totaled about $6.3 billion, a record crypto heist.
Save coverage image
20 outlets told this the same way.
Binance heist, North Korea denies
Binance said hackers stole more than $6 billion in what appears to be the largest cryptocurrency heist on record, and the FBI later said the theft was orchestrated by North Korean hackers tied to a hacking group known as TraderTraitor. North Korea denied involvement, and Kim Yo Jong called the FBI announcement “a trite provocation” and “an absurd rhetoric,” saying the United States was “blindly linking the DPRK with the ‘cyber crime’ incidents whenever they occur on an international scale.”
The dispute also played out as the FBI attributed the attack to TraderTraitor, which was also behind a $1.5 billion hack of the Bybit exchange last year, while Binance described the incident as a “serious and highly sophisticated security incident” and apologized, saying “this should not have happened.” The BBC reported that Binance suspended withdrawals for customers globally, meaning users could not get their cryptocurrency out of the platform until the service was restored on Sunday, and the incident led to customers withdrawing billions of dollars worth of assets after it reopened.
Fake interviews and AI tool
Binance said hackers used fake job interviews and a compromised internal AI tool, and the company said it gained access through a “sophisticated, multi-stage campaign.” Binance described how one of its engineers was contacted through a legitimate job-hunting platform and invited to bogus job interviews with fake company representatives, and Binance said the perpetrators used “more advanced and deceptive” methods to build trust.
Binance said the engineer was instructed to download malware masquerading as an “assignment” during a second interview, and the malware deployed malicious code with “obfuscation techniques” evading detection. Binance said it leveraged the engineer’s compromised computer and a compromised internal AI tool in October to gain control over two other engineers' laptops and execute the next steps of the attack, while it also said it would increase investment in AI tools that can detect security threats and engage third-party cyber experts for a full-scale review.
Frozen funds, customer coverage
Binance said it set aside more than 100% of the funds needed to cover the loss, and it said 98% of the token assets impacted had been “replenished” as of Saturday. The BBC reported that Binance said it had taken steps including working with law enforcement to trace and freeze affected assets, and it said it had also restored withdrawals after the incident.
Cointelegraph reported that Binance said the breach affected approximately $6.3 billion in digital assets, and it said Binance reported that $2.85 billion had been frozen or intercepted, while Binance said it would absorb the losses rather than pass them on to customers. ABC News reported that South Korea’s Foreign Ministry said North Korea’s illicit cyber activities pose an increasing threat to the global digital economy, and it said Seoul was closely cooperating with the United States and the broader international community to address the threat.