Two weeks after the massive Binance cyberattack, new details reveal that North Korean hackers exploited the exchange's own artificial intelligence tools to steal approximately $6.3 billion in cryptocurrency. Ori Segal, CEO of Cybore, told The Jerusalem Post that the attackers used one of Binance's internal AI models to compromise the computers of two engineers. While the rest of the attack followed traditional methods, such as a poisoned package manager, a fake recruiter, and credential reuse, Segal emphasized that the novel aspect was the use of the victim's own AI tools.
Segal noted that companies have little guidance on preventing such attacks, especially when they involve fake job interviews. Employees may hesitate to report suspicious activity if it means admitting they were job hunting on company devices. He suggested that companies should publicly state that employees won't be punished for reporting such incidents, even if they were job hunting. Additionally, he recommended using disposable virtual machines to run unvetted third-party code, which would eliminate the risk of infection.
The attack began in June and involved a multi-stage hacking effort. Hackers used a bogus job interview and malicious software hidden in an advertisement to compromise the engineers' computers. By the time Binance detected the breach late on Thursday, hackers had already stolen crypto for nearly four hours. The exchange scrambled to lock down its system and freeze withdrawals, but the damage was already done.