Billions of dollars in crypto stolen – in a hack that we are now learning involved corporate ambience coding efforts. One couldn’t imagine a more typical caveat in an era where employers are embracing AI at every level.
After hackers stole nearly $6.3 billion from the crypto platform, Binance has revealed how the thieves pulled off what could be the heist of the century.
In a detailed report on its investigation released Tuesday, the company described an elaborate scheme that unfolded for months, involving mock job interviews, old-fashioned phishing and, yes, a hacked AI tool.
It all started in June when an employee on Binance’s wallet development team thought he would indulge in some mood coding by installing a popular AI coding tool. But they ended up downloading a fake installation of Homebrew, a popular tool among software engineers, after clicking on a malicious ad. Binance said it detected the anomaly, replaced the device, and changed the relevant credentials.
So far so good, except that the attack exposed the role of the employee and his colleagues on the wallet team to the hackers, giving them the opening they needed. From there, some classic social engineering came into play. A hacker, posing as a project manager, contacted another software engineer through a legitimate job search platform to offer an interview first with a “human resources representative” and then with the “CEO” of a fake company.
The fraudsters then gained the employee’s trust by sharing a social media account with personal photos and videos, which Binance said “was more advanced and deceptive than social engineering approaches seen before.” (It’s not clear from the report, but perhaps these were made with AI, adding another element of AI threat to this story.)
Importantly, the follow-up interview was conducted via text message. The engineer was asked to complete and download a “mission” containing malicious code that executed instantly once the employee began installing it. One of the changes made was the replacement of a real developer tool with a malicious version capable of communicating with hackers and executing commands.
This all happened in September. Beginning in October, the hacker used the employee’s compromised machine to exploit an internal AI tool and use it as a “stepping stone” to take control of the computer and the computer of a third wallet developer. From there, they used credentials stolen from the first employee on the wallet team to log into the third employee’s computer and trigger a malicious script that launched the attack.
In total, the attack siphoned 233.46 million XRP, a form of crypto, from five wallets into the hacker’s wallets, then plundered other forms of crypto, including bitcoin, in what may well be the most lucrative heist of all time.
The culprits remain unclear. The FBI immediately blamed a notorious North Korean hacking organization, but Pyongyang denied any involvement. Binance, in its report, noted that it had thwarted “57 suspected cases of cyberthreats linked to North Korea” – up to at least the largest which breached their defenses.
Learn more about cybersecurity: Residents horrified as hackers take control of emergency alert system and warn of imminent nuclear attack
Gn bussni
