Binance claimed hackers used job interview to orchestrate $6.3 bn attack
&imwidth=600&imheight=450&format=webp&quality=medium "Binance claimed hackers used job interview to orchestrate $6.3 bn attack")
photo illustration of the Binance logo Photograph: (AFP)
Binance reveals how hackers used a fake job interview and compromised AI tools to steal $6.3 billion in crypto as Kim Yo Jong denies North Korea's role.
Binance said Tuesday that hackers used a bogus job interview to compromise a computer and an internal AI tool, gaining control of the company's wallets before draining $6.3 billion in crypto. The theft is widely seen as the largest in crypto history.
The attack was a sophisticated, multi-stage campaign, the exchange said in a preliminary report on its investigation. It began in June, when an employee on Binance's wallet developer team downloaded a tampered AI tool. Binance detected the problem, replaced the device and changed credentials, but the employee's role and those of others on the wallet team remained exposed. NPR reported that the "assignment" given to the engineer contained malicious code that let the hackers build out their attack.
On the day of the theft, Oct. 29, the attacker used the compromised computer to reach an internal AI tool and take control of two other machines, then logged into a third engineer's computer with credentials taken from the first. Fortune reported that the hackers posed as recruiters and approached a Binance employee through LinkedIn. A Binance spokesperson told the outlet that staff in non-public-facing roles are not allowed to keep LinkedIn profiles.
The FBI has blamed a North Korean hacking group, a claim Pyongyang rejects. Two blockchain intelligence firms linked the hack to TraderTraitor, a North Korean unit that has previously targeted the crypto industry.
Roughly $2.85 billion in assets has been frozen or intercepted, with Tether and Circle freezing stolen stablecoins. Binance said it has replenished 98% of the affected assets and will absorb the losses rather than its users. It halted withdrawals for about 48 hours and reopened them Saturday.
The company said it blocked 57 suspected North Korea-linked attempts this year and will bring in independent cybersecurity experts to review the incident. "This should not have happened," Binance said, apologising for the disruption and uncertainty it caused.
North Korea denies Binance's allegations
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied the allegations of Binance and labelled them as "grave political provocation" and “absurd rhetoric.”
"It is our clear stand that we have no need to sit face to face with such unreliable and hostile persons who refuse to abandon their policy of confrontation."
"To the hostile signals that the United States continuously sends, we do not know how to respond otherwise," she said.
