How Binance Suffered a $6.3 Billion Cyber ​​Heist: NPR

Hackers, widely believed to be from North Korea, tricked a Binance engineer into downloading malware that allowed them to carry out a $6.3 billion cyber-theft from the crypto exchange.

Dan Kitwood/Getty ImagesEurope

hide caption

toggle caption
I

Dan Kitwood/Getty ImagesEurope

The massive $6.3 billion cyber theft suffered by crypto exchange Binance last week may have happened in just about twenty minutes – but the attacks lasted for months.

That’s according to an initial assessment released Tuesday by Binance of how it suffered the largest-ever cyber heist by hackers the FBI identified as a North Korean state-sponsored unit.

These results show that hackers first attempted to test and penetrate Binance’s security systems in June, although the crypto exchange was able to detect this attempt and stop it.

Although unsuccessful, this attempt allowed the hackers – identified by the FBI as a North Korean military unit called TraderTraitor – to learn more about Binance and its systems.

Then the hackers tried again. In September, a Binance engineer was contacted on a job search platform by someone posing as a “project manager” at a company that turned out to be fictitious.

The engineer then conducted an initial interview with a supposed human resources representative of the fake company. The hackers used the interview to “build trust” with the Binance employee, the exchange said. The interviewer even shared supposed social media accounts, as well as personal photos and videos with the Binance engineer.

“This was more advanced and more deceptive than social engineering approaches seen before,” Binance said in its assessment.

Then the hackers rushed

The engineer was then informed that he would conduct a second interview with the company’s supposed CEO in a popular social chat app. It was during this interview that the Binance employee – who was in front of his work laptop – was asked to upload “an assignment” as part of the recruitment process.

Instead, the “mission” contained malicious code that allowed the hackers to develop an attack that culminated last week when the hackers stole more than $6 billion in cryptocurrencies held by Binance customers from the exchange.

Binance said in the statement published on X that the company is taking a series of measures, including an independent cybersecurity review to prevent future attacks. On Monday, the exchange said it had already replaced most of the cryptocurrencies stolen by customers using its own funds.