Binance's $6.3 Billion Hack Linked to Fake Job Interviews
Written with artificial intelligence.
Binance revealed that a $6.3 billion hack was orchestrated by North Korea-linked attackers through a deceptive job interview scheme. The attackers compromised employees and exploited vulnerabilities in the exchange's hot-wallet infrastructure over several months.
Overview of the Attack
In a recent briefing, Binance disclosed that the massive $6.3 billion hack was initiated through a series of fake job interviews conducted by attackers linked to North Korea. Richard Teng, Binance's executive, indicated that this was a carefully planned campaign that unfolded over several months, ultimately resulting in one of the largest thefts in cryptocurrency history.
Method of Intrusion
The attack began when a Binance software engineer was approached via a legitimate job platform by an individual posing as a project director. This impersonator conducted a fake HR interview via video, building trust by sharing personal photos. Following this, the engineer was instructed to download a coding assignment that contained malware, which bypassed existing security measures.
In a separate incident, another engineer inadvertently installed a compromised Homebrew package, leaving the wallet team vulnerable. On October 20, attackers utilized the compromised device alongside an internal AI tool to infiltrate two wallet engineers' computers. A malicious script was deployed, leading to funds being siphoned off starting at 20:05 UTC on October 29.
Exploitation of Wallet Infrastructure
The attackers exploited an Ethereum feature known as EIP-7702 to gain control over Binance's hot wallet. This mechanism, which involves multiparty computation, complicated the revocation of access, prolonging the containment of the breach until 00:10 UTC on October 30.
Financial Impact and Response
Binance reported that approximately $2.85 billion has been frozen and noted that nearly 98% of the impacted tokens have been replenished using company funds, ensuring that users remain unaffected. The exchange has thwarted 57 suspected North Korea-related attacks this year and plans to engage independent experts to evaluate the incident thoroughly.