The attackers reportedly used a fake recruitment process to gain access to a computer, setting the stage for a major security breach.
A fake recruitment process, a compromised computer, and an internal artificial intelligence tool were reportedly used to carry out the $6.3 billion attack on Binance, according to the cryptocurrency exchange’s initial investigation.
The world’s largest crypto exchange said the breach was the result of a series of security compromises that began in June and culminated in the theft of cryptocurrency on October 29. The attackers allegedly targeted members of Binance’s wallet development team through tampered software and a fraudulent job opportunity.
The FBI has attributed the attack to a North Korean hacking group, a claim rejected by North Korea. Binance has said it will reimburse customers who lost funds in the incident.
Binance Hack Began with Compromised Software
According to Binance’s report, the first security breach occurred in June when an employee from its wallet development team downloaded a tampered version of an artificial intelligence tool.
The exchange detected the suspicious activity, replaced the employee’s device, and changed the relevant credentials. However, the attackers had already gained exposure to the employee’s role and information about other members of the wallet development team.
This initial compromise reportedly gave the hackers information that helped them pursue further access within the organisation.
Fake Job Interview Helped Hackers Compromise Another Developer
A second breach followed in September, when another software engineer was looking for a new job.
The developer reportedly downloaded a malicious code repository after participating in what appeared to be a legitimate recruitment process. The process even included a virtual meeting with the CEO of a fictitious company, making the opportunity appear credible.
The fake interview was reportedly part of the attackers’ effort to compromise the developer’s computer and obtain access to systems connected to Binance’s wallet development team.
This approach used the trust associated with a routine professional activity to get malicious code onto a target’s device.
Internal AI Tool Helped Attackers Gain Access
On October 20, the attacker reportedly used the compromised computer alongside an internal AI tool to gain control of the wallet developer’s system and that of another developer on the same team.
The attackers then used credentials stolen from the first developer to access the second developer’s computer.
On October 29, they triggered a malicious script from that device, setting off the attack that resulted in the theft of approximately $6.3 billion in cryptocurrency.
The sequence described by Binance points to multiple stages of compromise rather than a single security failure. The initial software infection, fraudulent recruitment process, stolen credentials, and access to internal systems all contributed to the final breach.
Binance Promises Customer Reimbursement After the Attack
In its report, Binance acknowledged the seriousness of the incident and apologised to those affected.
“This should not have happened, and we apologize for the concern, disruption, and uncertainty it caused our users, partners, and the wider industry,” the company said.
Binance has stated that it will cover customer losses resulting from the attack, seeking to reassure users following one of the largest reported cryptocurrency thefts.
The FBI’s attribution of the incident to a North Korean hacking group has added an international dimension to the investigation. North Korea has rejected the allegation.
Binance Plans Greater Investment in AI-Based Security
Following the breach, Binance said it would increase investment in AI-enabled threat detection and strengthen its security infrastructure.
The company is also working to establish a security research fund and develop targeted initiatives with major artificial intelligence companies.
The incident has drawn attention to the risks associated with compromised developer tools, fraudulent recruitment exercises, and the use of stolen employee credentials.
For cryptocurrency exchanges, the breach shows how attackers can exploit routine workplace activities to access systems that control large amounts of digital assets. Security measures must therefore account not only for external attacks but also for risks introduced through employees’ devices, software downloads, and internal access.
Read more news and follow us on Instagram.
Binance said that as a result of the hack, it was increasing investment in AI-enabled detection. Photo: KT File
Source: KT
