Hackers behind $6.3 billion Binance heist ‘used malware and fake job interviews’ | Binance

Hackers behind the $6.3bn (£4.7bn) Binance heist used fake job interviews, malware and an in-house AI tool, the company has revealed.

The world’s largest cryptocurrency exchange was compromised in an operation that began with an accidental malware download in June, led to a recruiting scam in September and then a raid last week on “hot wallets” where billions of dollars in crypto assets were stolen.

The FBI blamed last week’s heist on North Korea, but Pyongyang, a prolific cryptocurrency hacker, on Tuesday called the accusation “absurd rhetoric.”

According to an update released by Binance on Tuesday, hackers first gained a foothold this summer when a company engineer inadvertently uploaded malware that exposed the employee’s role and that of other members of the team that looked after Binance’s crypto wallet infrastructure.

A fake project manager then contacted another engineer on a legitimate job search platform, leading to a first video interview with a fake HR representative and a second interview – on a chat app – with the “general manager” of a fictitious company. It was during the second interview that the engineer was induced to download malware onto his computer.

On October 20, the attacker used the compromised computer along with an internal AI tool to take control of the engineer’s system and that of a second wallet developer on the same team. Then, on October 29, the attacker used the second developer’s computer, using the first engineer’s stolen credentials, and triggered a malicious script to launch the attack.

Binance said $2.85 billion of the $6.34 billion drained from crypto wallets in the attack had been frozen or intercepted.

Fake job interviews are a known part of North Korea’s cyber arsenal, but they usually come from the other side of the process, where fake IT professionals apply for jobs in order to redirect money to Pyongyang.

“This should not have happened, and we apologize for the worry, disruption, and uncertainty this has caused our users, our partners, and the industry as a whole,” Binance said in the update.

The FBI said Saturday that North Korea was responsible for the hack.

But Kim Yo-jong, the influential sister of North Korean leader Kim Jong-un, said Tuesday that the allegations proved that Washington remained hostile toward Pyongyang, according to the North’s KCNA news agency.

“The FBI is attempting to label the DPRK (Democratic People’s Republic of Korea) as a ‘cybercriminal state,’ claiming it obtained information that a DPRK ‘backed’ hacking organization was involved in the incident,” she said, citing KCNA.

“But the US claim ‌is absurd rhetoric and is nothing new,” said Kim, a ruling party official.

“The fact that the United States is misleading international public opinion as if all cybercrimes committed in different parts of the world are our doing constitutes a serious political provocation against the DPRK.”