The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed. The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of “hot wallets” where billions of dollars worth of crypto-assets were taken. The FBI has blamed North Korea for last week’s heist but Pyongyang, a prolific crypto-hacker, described the accusation as “absurd rhetoric” on Tuesday.
According to an update Binance released on Tuesday, the hackers got their first foothold in the summer when a company engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s cryptowallet infrastructure. A fake project director then contacted a different engineer on a legitimate job-hunting platform, leading to a first-round video interview with a sham HR representative and a second-round interview – on a chat app – with the “chief executive” of a fictitious company. It was during the second interview that the engineer was tricked into downloading malware on to his computer.
On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer’s system and that of a second wallet developer on the same team. Then on 29 October, the attacker used the second developer’s computer, using stolen credentials from the first engineer, and triggered a malicious script to launch the attack. Binance said $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted.
Deepfake job interviews are a known part of North Korea’s cyber-arsenal, but normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang. The FBI said on Saturday that North Korea was responsible for the hack. But Kim Yo-jong, the influential sister of the North Korean leader Kim Jong-un, said on Tuesday that the allegations proved Washington remained hostile towards Pyongyang, according to North Korea’s state news agency, KCNA.
Extract — continue reading at the source.
