The biggest heist in cryptocurrency history began with small mistakes many internet users make. A hacking group tied to North Korea recently stole $6.3 billion from the crypto exchange Binance. The operation was sophisticated, involving fake job interviews and malicious code.
But it was also mundane. Although artificial intelligence played a role in the hack, this was not a cyberattack of the future, propelled by swarms of AI agents. Rather, it relied on humans who made some basic errors, like clicking a link because it appeared first on a search results page or trusting strangers at a fake company without taking a few seconds to look them up.
We work at the Digital Inquiry Group, a nonprofit that researches how people evaluate online information and creates free, evidence-based curriculum that helps people decide what to trust.
In over a decade of research, we've found that people frequently engage in online behavior that makes them more likely to get duped. Two simple strategies can help you better navigate today's information landscape, from traditional phishing to misleading social posts to AI fakes. Here's how.
The Binance heist began when one of the company's engineers downloaded compromised software. That engineer, according to the Reuters investigation of the hack, clicked on a sponsored search result that appeared higher on the results page and directed them to the malicious code.
Our research at the Digital Inquiry Group suggests internet users frequently behave as if first is best. They click on the first thing they see. They incorrectly associate a higher placement with vetted content, ceding judgment to tech company algorithms. Students have gone so far as to tell us "Google is almost never wrong" or "AI is always right."
Professional fact-checkers commonly practice click restraint. They understand that whether you're searching on the internet or querying a chatbot, first isn't always best. If you're researching an organization, the first link will often be to its own site, which is hardly likely to disclose anything that's wrong with it.
So the next time you search for something online, be wary of links to sponsored content, the organization you're investigating, or to open platforms where anyone can post and information isn't verified, such as Quora or Reddit. Read the brief snippets beneath each link, and make a more informed choice about what to open.
Always ask yourself: Who is behind this information? What makes them credible? Look for people and organizations that have direct expertise on the topic at hand, or have processes to ensure the accuracy of information, such as news outlets that employ editors and fact-checkers.
Binance says it caught that first malicious download, replaced the device and changed passwords. But later, another engineer downloaded compromised code as part of what they thought was a job interview, which included a virtual meeting with the supposed CEO of a fake company.
It's tempting to think that the engineer should have seen something was off. But the internet is a precarious place because bad actors know how to make content feel legitimate. Binance says its employee was snared by a hacker posing as an HR rep who "shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust."
When they encounter a piece of unfamiliar content, professional fact-checkers don't just read it closely — they read laterally. They open new browser tabs to see what other, credible sources have to say. Fact-checkers know that bad actors make themselves look good on their home turf, but that it's a lot harder to fake a good reputation across the internet.
The next time you encounter something unfamiliar online, look for authoritative sources that can shed light on the person or organization. You might find a news article that confirms the claim you're looking into, or a report that identifies a supposedly neutral source as biased.
In some cases, you may find nothing at all, which is a signal in itself: if you look up a company that reached out to you and find no external confirmation of its existence, that should be an immediate red flag.
Had that first Binance engineer engaged in click restraint and verified the source of the software, they might have avoided the malicious download. Had that second employee taken time to seek external verification about the supposed HR rep, rather than trusting a polished social media profile, they might have realized that something didn't add up.
The internet and AI have made it harder to know whether what we see is authentic. They've also made it easier than ever before to investigate who or what we encounter online. It's always worth pausing to check. A few seconds up front can save us all a lot of time, grief and money later on.
Nadav Ziv is a researcher at the Digital Inquiry Group. Joel Breakstone is co-founder and executive director of the Digital Inquiry Group.
