Binance: Hackers Used Fake Job Interviews to Steal $6.3 Billion in Cryptocurrency

In the initial Binance report, it is stated that the attack preceding the theft of $6.3 billion began in June: an engineer from the wallet infrastructure team downloaded a modified version of an AI programming tool. After detecting the issue, the company replaced the device and updated related credentials, but the positions of the team members became known to the attackers.

In September, a Binance engineer received a message on a job search platform from an individual posing as a project director. He was then offered a video interview with an HR employee and a conversation with the 'CEO' of a non-existent company. During the second stage, the engineer was asked to download a test assignment containing malicious code onto his work computer.

On October 20, the attackers used the compromised engineer's computer and an internal AI tool to gain control over the systems of other wallet team members. Binance CEO Richard Teng described the attack as a months-long campaign. The FBI linked the theft to hackers from North Korea, though North Korea denies involvement. Binance is engaging external cybersecurity experts and increasing investments in AI threat detection systems.