Binance Details $6.3B Heist: North Korean Hackers Used Fake Job Offer to Breach Wallet Engineer
Binance has confirmed that the record $6.3 billion cryptocurrency theft disclosed last week stemmed from a months-long social engineering campaign attributed to North Korean state-sponsored hackers. The attackers posed as recruiters, lured a software engineer on Binance's wallet team through a fake interview process, and delivered malware disguised as a coding assignment that went undetected by Binance's security tools. From that foothold, the hackers pivoted through an internal tool to compromise two more engineers, including one previously infected via a trojanized app downloaded from search results, eventually gaining access to systems controlling billions in crypto. Binance says it has since improved network security and will bring in external cybersecurity experts to review the incident, which it says it faced in at least 57 prior suspected North Korean intrusion attempts.
Detalhes técnicos
The attack chain began with a fake recruiter persona contacting a Binance wallet engineer; after two interviews, the target was told to download a coding assignment that contained malicious code, compromising their work laptop undetected. This access was leveraged to reach an internal administrative tool capable of taking over other engineers' machines. A second engineer had separately been compromised months earlier by a tampered application containing credential-stealing malware found via search engine results. Stolen credentials from that engineer were used to access a third engineer's system, which had privileged access to crypto custody infrastructure, enabling the theft.
Remediação
Binance states it has implemented new security measures following the breach and will engage third-party cybersecurity experts to review the incident; the article notes the company has not detailed what controls prevent unauthorized or untrusted code execution on employee laptops.
Linha do tempo
-
Binance Details $6.3B Heist: North Korean Hackers Used Fake Job Offer to Breach Wallet Engineer
ler a análise desta fonte ocultar
Binance has confirmed that the record $6.3 billion cryptocurrency theft disclosed last week stemmed from a months-long social engineering campaign attributed to North Korean state-sponsored hackers. The attackers posed as recruiters, lured a software engineer on Binance's wallet team through a fake interview process, and delivered malware disguised as a coding assignment that went undetected by Binance's security tools. From that foothold, the hackers pivoted through an internal tool to compromise two more engineers, including one previously infected via a trojanized app downloaded from search results, eventually gaining access to systems controlling billions in crypto. Binance says it has since improved network security and will bring in external cybersecurity experts to review the incident, which it says it faced in at least 57 prior suspected North Korean intrusion attempts.
Technical Details
The attack chain began with a fake recruiter persona contacting a Binance wallet engineer; after two interviews, the target was told to download a coding assignment that contained malicious code, compromising their work laptop undetected. This access was leveraged to reach an internal administrative tool capable of taking over other engineers' machines. A second engineer had separately been compromised months earlier by a tampered application containing credential-stealing malware found via search engine results. Stolen credentials from that engineer were used to access a third engineer's system, which had privileged access to crypto custody infrastructure, enabling the theft.
Remediation
Binance states it has implemented new security measures following the breach and will engage third-party cybersecurity experts to review the incident; the article notes the company has not detailed what controls prevent unauthorized or untrusted code execution on employee laptops.