Fake interviews, compromised laptops, and dodgy software packages: How the Binance hack happened

Hackers who stole $6.3 billion from Binance gained access to company systems via fake job interviews before taking advantage of a flaw in an internal AI tool.

Last week, Binance admitted a security breach that saw $6.3bn (£4.7bn) stolen by hackers, though the company said half of those assets had been frozen.

At the time, Binance said its initial investigation suggested a single developer's laptop may have been compromised, but the company and authorities have since offered more details, pinning the blame on fake job interviews being used to access corporate systems.

In a statement, the FBI attributed blame for the attack on North Korea, confirming initial reports by security researchers pointing to the state-sponsored TraderTraitor group. The FBI said it had seen TraderTraitor actors "converting stolen assets primarily into Ether”.

Binance, in a separate statement posted to social media, explained that the "sophisticated" attack started several months ago.

"It was not a single isolated breach or a simple phishing incident," the statement reads.

"The attackers combined a range of techniques, including social engineering by fake recruitment interviews, malicious software downloads, compromised internal AI tooling, endpoint compromise, and an advanced transaction-authorization method."

How the Binance hack happened

In June, an engineer at Binance unwittingly downloaded a dodgy version of the Homebrew package manager to install an AI coding tool.

While that was spotted by Binance's security team and the engineer's credentials were reset, the hackers still gained information about the employee's role and teammates.

Over the next several months, Binance's security team spotted 57 cyber threats that they believed originated in North Korea, with techniques as varied as dodgy job interviews, social engineering campaigns, and malicious software.

In September, a different engineer was contacted by a legitimate job hunting platform by someone pretending to be a recruiter, which led to two interviews, the latter of which required the engineer to download an "assignment" — which included malicious code.

"The malware employed sophisticated obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version to execute commands and establish communication with an attacker-controlled external server," Binance said.

"The zero-day malware was not detected by the endpoint security protection tools at the time."

On 20 October, the hackers used the compromised laptop of the engineer to access an internal Binance AI tool to take over the wallets of the first engineer, as well as a third engineer, lurking for more than a week before using stolen credentials to launch the attack.

What next?

"We have taken immediate action to contain the incident and strengthen the systems involved," Binance said in its statement.

"The entry points identified as having been used in the attack have been closed. Systems touched in the attack path have been rebuilt or replaced. We have also implemented tighter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection."

The crypto firm added that further details would be divulged as the investigation continued, and would be subject to independent review via third-party security companies.

Liam Salsi, director of architecture at Talion Cyber Security, said it was "astounding" that a few compromised laptops could lead to such a massive financial transaction.

"Good security is always about segmenting and spreading your assets, so that if an attacker does get into the network, they can’t take everything with a single swipe," says Salsi.

"Clearly Binance didn’t get the memo, because what we’re seeing here is not just putting all your eggs in one basket, they left the crown jewels, the house and the car in there as well."

Paying back lost funds

Beyond the details about the attack vector, Binance said that it would cover any currency lost from users' wallets, saying the vast majority of lost tokens were already replenished.

"Our first responsibility is to protect users," the statement noted. "Binance will absorb the financial impact of the stolen funds, not our users. We have already set aside more than 100% of the funds required to cover the loss."

Of the $6.34bn impacted, $2.85bn had been frozen or intercepted, the company added.

"Binance clearly has very deep pockets and appears to be recovering quickly from this attack, but imagine if this had been another industry or business," added Salsi.

"For instance an operator of critical national infrastructure? If a provider followed the same principles as Binance, where a few compromised devices could initiate a huge operational change, we could be in a very different situation."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.