North Korean hackers used an elaborate scheme to pull off their $6.3 billion hack of Binance last week, the crypto exchange said — approaching one of its engineers as a fake company and conducting a series of phony job interviews before hacking into his computer.
An initial investigation into what has been called the largest bank heist in history revealed that the record-breaking cyberattack was much more complex than previously known – starting back in June and involving ads for tampered software, stolen credentials and fake interviews.
In June, hackers laid the groundwork for their attack when an employee at Binance, referred to as “Engineer A,” downloaded tampered software found online that had been disguised and advertised as a popular AI coding tool.
Binance said its security team detected the malware and immediately replaced the device and all employee credentials – but the attackers had already learned of Engineer A and his related colleagues’ roles at the firm.
In September, “Engineer B” was contacted through a legitimate job-search platform – where he had a profile including his experience at Binance – by a person posing as a project director at a company.
He completed a first-round interview with someone posing as an HR representative, who shared photos and videos from a social media account to make themselves appear legitimate, the company said.
Toward the end of a second-round interview with a person pretending to be the CEO of a fake company, Engineer B was instructed to download an “assignment” onto his work computer that actually contained malicious code – setting off a chain of unauthorized activities.
On Oct. 20, the attacker used the compromised computer and an internal AI tool to gain control over Engineer A and another Engineer C and discovered that Engineer A had a deployment permission token – a specialized credential – on his computer.
The hackers then used the credentials stolen from Engineer A to launch the massive attack on Oct. 29, draining billions of dollars from crypto wallets within 20 minutes and quickly spreading the riches across global networks.
On Saturday, the FBI linked the notorious North Korean state-backed cybercrime group TraderTraitor to the heist. TraderTraitor is known for quickly laundering stolen booty across vast crypto networks, making it virtually impossible to recover.
North Korea has denied any ties to the attack, calling the accusation a “grave political provocation,” according to state-backed media.
But Binance said the $6.3 billion drain was just the latest attack from suspected North Korean hackers – adding that it detected and blocked a whopping 57 suspected North Korea-linked threats so far this year.
“This should not have happened, and we apologize for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said Tuesday.
“We have taken immediate action to contain the incident and strengthen the systems involved. The identified entry points used in the attack have been closed, systems touched in the attack path have been rebuilt or replaced, and we have implemented tighter device controls, enhanced wallet-service risk controls and expanded AI anomaly detection.”
The crypto exchange also said it is engaging independent security firms for further review and that its own investigation remains ongoing.
After the hack was first detected Thursday evening, Binance worked with other exchanges and stablecoin providers to quickly freeze about $2.8 billion – meaning about $3 billion was lost forever.
It also paused withdrawals and vowed to cover all losses in full. As of Oct. 31, 98% of the impacted tokens have been replenished, and the company is in the process of purchasing the remaining 2% of stolen funds, which “are less liquid in the market and take longer to source at the required scale.”
Binance set aside over $6 billion of company funds to cover customer losses, including half of its $1 billion Secure Asset Fund for Users, or SAFU, and its own corporate treasury. It has said it is committed to replenishing SAFU to return it to roughly $1 billion.
In the meantime, its balance sheet still holds $157 billion in current total assets – even after the heist, a stunning $4.7 billion in customer withdrawals and subsequent market fluctuations, according to the company.
This story originally appeared on NYPost
