Binance says hackers used a fake job interview to steal $6.3B in crypto
Binance, which NBC News calls the world's largest crypto exchange, said on a Tuesday that hackers used a bogus job interview to compromise a computer, and an internal artificial intelligence tool to gain control over the company's wallets, before draining $6.3 billion worth of crypto. NBC News writes that this could be the largest-ever financial heist. The claim is the article's own hedged wording, and no comparison figures are given.
The account comes from Binance's initial report into what went wrong. It describes a sophisticated operation that began in June with an advertisement for a tampered version of a coding tool, set off a chain of security breaches, and ended with the theft on Oct. 29.
The sequence, as Binance tells it:
In June, an employee on the wallet developer team downloaded an AI tool that had been tampered with. Binance detected this, replaced the device and changed credentials. But the employee's role, and the roles of others on the wallet team, were exposed to the hacker.
In September, a second software engineer who was seeking a new job downloaded a "malicious code repository" onto his computer. He had interviewed for what he thought was a legitimate role, including a virtual meeting with the CEO of a fictitious company.
On Oct. 20, the attacker used the compromised computer plus an internal AI tool to gain control of one wallet developer's system and that of a second wallet developer on the same team.
On Oct. 29, the attacker used the second wallet developer's computer, with credentials stolen from the first wallet developer, and triggered a malicious script to launch the attack.
The FBI has blamed a North Korean hacking group, a claim North Korea has rejected. Binance says it is repaying all customers who have lost funds through the hack. In the report it said: "This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry." As a result of the hack, Binance is increasing investments in AI-enabled detection and is working on establishing a security research fund and targeted initiatives with leading AI companies.
Key facts
- Binance says $6.3 billion worth of crypto was drained on Oct. 29, after hackers used a bogus job interview and an internal AI tool to gain control of its wallets.
- The chain began in June, when a wallet-team employee downloaded a tampered AI tool; a second software engineer downloaded a "malicious code repository" in September after a fake interview that included a virtual meeting with the CEO of a fictitious company.
- On Oct. 20 the attacker took control of two wallet developers' systems; on Oct. 29 the attacker used the second developer's computer, with the first developer's stolen credentials, to trigger a malicious script.
- The FBI has blamed a North Korean hacking group; North Korea has rejected the claim.
- Binance says it is repaying all customers who lost funds and is increasing investment in AI-enabled detection.
Why it matters
The sum is $6.3 billion worth of crypto, and NBC News says it could be the largest-ever financial heist. The route matters as much as the amount. According to Binance, the attack did not start with a flaw in the exchange's own systems. It started with an advertisement for a tampered coding tool and a fake job offer, and it used an internal AI tool to reach the company's wallets. The slow build is also notable: June to Oct. 29.
Who it affects
Binance's customers are the most direct group: the company says it is repaying all those who lost funds. The wallet developer team is where the breach spread, with one employee's role and those of others on the team exposed to the hacker. The article also describes a software engineer who was looking for a new job and was lured by a fictitious company. Binance says it is now increasing investment in AI-enabled detection and working on a security research fund and initiatives with leading AI companies.
How to use it
This is an incident report, not a product, so there is nothing to adopt. What the account offers is a list of entry points it names: a tampered version of a coding tool that was advertised, a tampered AI tool downloaded by an employee, and a "malicious code repository" downloaded during an interview for a seemingly legitimate role. In Binance's telling, each of these let the attacker onto a machine that later mattered.
How solid is it
The step-by-step account is Binance's own, from its initial report, as relayed by NBC News. The FBI's attribution to a North Korean hacking group is separate and is rejected by North Korea. No evidence for the attribution is given in the article. NBC News's "largest-ever" comparison is hedged with "could be".
Risks and caveats
This is an initial report, and the article leaves several things open. The tampered tool is not named; the article calls it both a coding tool and an AI tool. It does not say how the internal AI tool was used to gain control of the wallets. It does not name the North Korean group, the employees or the fictitious company. It does not say whether any funds were recovered or how much Binance has repaid so far. It does not say how the $6.3 billion was valued. No year is given for the events.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry”
— Binance, in its report