Binance said its preliminary investigation into the Oct. 29 security incident found that the roughly $6.3 billion theft began with a fake recruitment approach. In September, a Binance software engineer was contacted on a legitimate job platform by someone posing as a project director, then went through a fake HR video interview and a second interview with a fake CEO. The engineer was later asked to download a code repository as an assignment on a work computer. Binance said the repository contained a zero-day trojan that bypassed endpoint protection. The attackers then used the compromised device and internal AI tools to take control of two other wallet engineers’ computers, steal deployment credentials, and run a malicious script on Oct. 29 to move funds. Binance said it has frozen or intercepted about $2.85 billion and has made up 98% of affected assets. The exchange added that the method closely resembled the March 2022 Ronin bridge hack tied to Axie Infinity, in which the North Korea-linked Lazarus Group used a fake high-paying job process on LinkedIn to compromise a Sky Mavis senior engineer and steal about $625 million. Binance also said it has detected and blocked 57 suspected North Korea-linked cyberattacks this year.
Binance said a preliminary investigation into its Oct. 29 security incident found that the theft of roughly $6.3 billion began with a fake recruitment scheme.
According to the exchange, a Binance software engineer was contacted in September on a legitimate job platform by someone posing as a "project director." The engineer then went through a fake HR video interview and a second interview with a fake "CEO" before being asked to download a code repository as an assignment on a work computer. Binance said the repository carried a zero-day trojan that bypassed endpoint protection.
The attackers later used the compromised device and internal AI tools to gain control of the computers of two other wallet engineers, steal deployment credentials, and ultimately run a malicious script on Oct. 29 to move funds, Binance said.
Binance added that it has frozen or intercepted about $2.85 billion and has replenished 98% of affected assets.
Tactics compared with the 2022 Ronin bridge hack
Binance said the method closely resembled the March 2022 theft from the Ronin cross-chain bridge used by Axie Infinity.
In that case, the North Korea-linked Lazarus Group approached a senior engineer at Sky Mavis on LinkedIn with a high-paying job opportunity. After multiple rounds of interviews, the attackers sent a trojanized offer file, gained control of validator node private keys, and stole about $625 million.
Binance says it blocked 57 suspected related attacks this year
Binance also said it has detected and blocked 57 cyberattacks this year that it suspects were linked to North Korea. The techniques included fake interviews, malware disguised as developer tools, tampered software packages, and browser extensions.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
