Binance, the world's largest cryptocurrency exchange, revealed on Tuesday that hackers used elaborate tactics, including fake job interviews, to execute a $6.3 billion crypto heist. The attack, which occurred on October 29, was described by CEO Richard Teng as a "months-long campaign" and one of the most sophisticated in the digital asset industry's history.
The breach began in June when an engineer on Binance's wallet infrastructure team downloaded a tampered version of an AI coding tool. Although the company's security team addressed the issue, the hackers had already exposed the engineer's role and those of his colleagues. In September, the same engineer was contacted through a legitimate job-hunting platform by an individual posing as a Project Director. The fake recruiter arranged interviews, including a video call with a fabricated HR representative who shared personal photos to build trust. During the second interview, the engineer was instructed to download a malicious code repository onto his work computer, which initiated unauthorized activities.
On October 20, the hackers leveraged the compromised computer to gain control of systems used by two other engineers on the wallet team. On the day of the heist, the attacker used stolen credentials to deploy a container and trigger a malicious script. Binance has since frozen or intercepted $2.85 billion of the stolen assets and has replenished 98% of the impacted tokens, with withdrawals broadly resuming.
In response, Binance is bringing on third-party cybersecurity experts, increasing its investment in AI-enabled detection, and working to establish a research fund focused on AI security in blockchain systems. The FBI has attributed the theft to North Korean hackers, though the country has denied any involvement.