Fake job interview, AI hijacking… Binance reveals the modus operandi of the record hack of which it was the victim

Binance published on Tuesday (November 3) a detailed account of the preparations for the attack which allowed hackers to steal $6.3 billion from the cryptocurrency exchange platform, using fake job interviews and hijacking internal artificial intelligence (AI) models.

The group indicated that it had reconstituted 98% of the stolen assets by drawing on its own funds, the balance relating to digital currencies that are little traded and more difficult to acquire. The offensive, carried out over approximately four hours on October 29, was attributed by the Federal Police (FBI) to computer scientists affiliated with North Korea, which denied it. Some 2.85 of the 6.34 billion have been frozen, meaning digital burglars cannot use them or convert them to another currency.

Four months of preparation

According to Binance, the perpetrators of the intrusion took their first steps as early as June, more than four months before launching the attack. They first managed to get a platform engineer to download a truncated version of programming software known in the industry (Homebrew), which contained a virus. Binance's cybersecurity teams spotted the malware and removed it, but the hackers had time to gather information about the engineer and his colleagues, allowing them to better understand who and where to target during the assault.

In September, the clandestine team contacted another Binance engineer to offer him a position at a fake company through a job search platform. Interested, the Binance employee conducted two remote interviews with fake company representatives. In the second, he was asked to download an interview exercise, which contained malware. It was this incident that proved decisive in the success of the attack.

This program notably made it possible to replace an internal programming tool with a corrupted version, which was then used to establish an external connection with the hackers. On October 20, the latter used the compromised computer to use an internal Binance AI tool and take control of software from two other engineers, before launching the attack nine days later.