Fake Job Interview Social Engineering Chain Leads to Binance's Record-Breaking Crypto Heist
Binance disclosed that a months-long, multi-stage social engineering and malware campaign — not a single breach — led to a record-breaking theft of crypto assets. Attackers posed as recruiters on a legitimate job-hunting platform to target multiple Binance software engineers, building trust over fake interviews before delivering a malicious code repository disguised as a technical assignment. The resulting zero-day malware used obfuscation and evasion techniques, replacing a legitimate development tool component to execute commands and establish C2 communication. From this initial foothold, attackers pivoted through an internal AI tool to compromise additional wallet engineers, eventually obtaining a container deployment token and stolen credentials that let them deploy a malicious container and drain Binance hot wallets.
Detalhes técnicos
The intrusion began in September when an attacker posing as a project director contacted "Software Engineer B" via a job platform, followed by fake HR and social-chat interviews designed to build trust before delivering a malicious "assignment" repository that executed during setup. Separately, in June, "Wallet DevOps Engineer A" had been compromised via a malicious version of Homebrew downloaded after clicking a malicious search ad; though the device was replaced and credentials rotated, the attacker had already learned the roles of the wallet team. On October 20, the attacker used Engineer B's access to an internal AI tool to pivot into the machines of Engineer A and "Wallet Software Engineer C," discovering a container deployment permission token on Engineer A's device. On October 29 between 17:15–19:56 UTC, the attacker logged into Engineer C's machine using Engineer A's stolen credentials, deployed a container, and triggered a malicious script. Between 20:05 and 20:09 UTC, five Binance hot wallets sent approximately 233.46 million XRP, 970,500 SOL, and 44.2 million OP to attacker-controlled addresses. Binance stated it has detected and prevented 57 suspected North Korean attacks this year.
Remediação
Binance rebuilt the affected wallet system and internal AI tool, strengthened the AI tool's access controls, replaced affected devices, decommissioned exposed engineer credentials and tokens, enhanced device security scanning, improved AI-based behavioral anomaly detection, and strengthened wallet service risk controls. The firm is conducting an incident review and establishing a security research fund with industry partners.
Linha do tempo
-
Fake Job Interview Social Engineering Chain Leads to Binance's Record-Breaking Crypto Heist
ler a análise desta fonte ocultar
Binance disclosed that a months-long, multi-stage social engineering and malware campaign — not a single breach — led to a record-breaking theft of crypto assets. Attackers posed as recruiters on a legitimate job-hunting platform to target multiple Binance software engineers, building trust over fake interviews before delivering a malicious code repository disguised as a technical assignment. The resulting zero-day malware used obfuscation and evasion techniques, replacing a legitimate development tool component to execute commands and establish C2 communication. From this initial foothold, attackers pivoted through an internal AI tool to compromise additional wallet engineers, eventually obtaining a container deployment token and stolen credentials that let them deploy a malicious container and drain Binance hot wallets.
Technical Details
The intrusion began in September when an attacker posing as a project director contacted "Software Engineer B" via a job platform, followed by fake HR and social-chat interviews designed to build trust before delivering a malicious "assignment" repository that executed during setup. Separately, in June, "Wallet DevOps Engineer A" had been compromised via a malicious version of Homebrew downloaded after clicking a malicious search ad; though the device was replaced and credentials rotated, the attacker had already learned the roles of the wallet team. On October 20, the attacker used Engineer B's access to an internal AI tool to pivot into the machines of Engineer A and "Wallet Software Engineer C," discovering a container deployment permission token on Engineer A's device. On October 29 between 17:15–19:56 UTC, the attacker logged into Engineer C's machine using Engineer A's stolen credentials, deployed a container, and triggered a malicious script. Between 20:05 and 20:09 UTC, five Binance hot wallets sent approximately 233.46 million XRP, 970,500 SOL, and 44.2 million OP to attacker-controlled addresses. Binance stated it has detected and prevented 57 suspected North Korean attacks this year.
Remediation
Binance rebuilt the affected wallet system and internal AI tool, strengthened the AI tool's access controls, replaced affected devices, decommissioned exposed engineer credentials and tokens, enhanced device security scanning, improved AI-based behavioral anomaly detection, and strengthened wallet service risk controls. The firm is conducting an incident review and establishing a security research fund with industry partners.