Hackers used fake job interviews to break into the system and steal $6.3 billion from Binance

The Binance logo is seen on a smartphone, on February 28, 2023, in Marple Township, Pennsylvania. — Photo: Matt Slocum/AP

In an initial report on what went wrong, the world's largest cryptocurrency exchange detailed a sophisticated operation that began with an announcement of a tampered version of a programming tool in June and triggered a series of security breaches that culminated in the biggest theft in history on October 29.

The United States Federal Police (FBI) attributed responsibility to a North Korean group of hackers, an allegation that North Korea rejects.

Binance explained that the theft began when, in June, an employee on the wallet development team downloaded an artificial intelligence tool that had been tampered with. The exchange detected the problem, replaced the device and changed the credentials, but the roles of this employee and other wallet team members were exposed to the hacker.

In September, a second software engineer looking for a new job downloaded a “malicious code repository” onto his computer after interviewing for what the person believed to be a legitimate position, including a virtual meeting with the chief executive of a fictitious company.

On October 20, the attacker used the compromised computer and an internal AI tool to gain control of the wallet developer's system and the machine of a second developer on the same team.

On October 29, the hacker used the second wallet developer's computer, using credentials stolen from the first developer, and triggered a malicious script to launch the attack.

“This should not have happened, and we apologize for the concern, inconvenience and uncertainty this has caused to our users, partners and the industry as a whole,” Binance said in the report