Billions of dollars of crypto stolen — in a hack that we’re now learning involved corporate vibe coding efforts. You couldn’t come up with a more quintessential cautionary tale for an era when employers are embracing AI at every level.
After hackers drained nearly $6.3 billion from the crypto platform, Binance has revealed how the thieves pulled off what might be the heist of the century.
In a detailed report on its investigation published Tuesday, the company described an elaborate scheme that took place over months involving sham job interviews, old-fashioned phishing, and — yes — a hijacked AI tool.
It began in June when an employee on Binance’s wallet developer team thought they’d indulge in some vibe coding by installing a popular AI coding tool. But they ended up downloading a tampered installation of Homebrew, a tool that’s popular with software engineers, after clicking a malicious ad. Binance said it detected the anomaly, replaced the device, and changed relevant credentials.
So far so good, except that the attack exposed the role of the employee and his colleagues on the wallet team to the hackers, giving them the opening they needed. From there, some classic social engineering went into play. A hacker, posing as a project director, reached out to another software engineer through a legitimate job-hunting platform to offer an interview first with an “HR representative” and then the “CEO” of a fake company.
The fraudsters then earned the employee’s trust by sharing a social media account with personal photos and videos, something that Binance said “was more advanced and deceptive than previously seen social engineering approaches.” (It’s unclear from the report, but perhaps these were fabricated with AI, adding another element of AI menace to this story.)
Crucially, the follow-up interview was conducted over text. The engineer was asked to complete and download an “assignment” that contained malicious code that instantly executed once the employee began installing it. Among the things it changed was replacing a real development tool with a malicious version that could communicate with the hackers and execute commands.
That all took place in September. Starting in October, the hacker used the compromised employee machine to leverage an internal AI tool and use it as a “springboard” to seize control of the computer and the computer of a third wallet developer. From there, they used credentials stolen from the first wallet team employee to log into the third employee’s computer and trigger a malicious script that launched the attack.
In all, the attack siphoned 233.46 million XRP, a form of crypto, from five wallets into the hacker’s wallets, and then plundered other forms of crypto including bitcoin, in what may well have been the most lucrative heist of all time.
The culprits remain unclear. The FBI immediately blamed a notorious North Korean hacking outfit, but Pyongyang has denied involvement. Binance, in its report, noted that it had thwarted “57 suspected North Korea-linked cyber threat cases” — up until the big one that breached their defenses, at least.
More on cybersecurity: Residents Horrified as Hackers Seize Control of Emergency Alert System and Warn of Incoming Nuclear Attack
The post It Turns Out Binance’s $6 Billion Hack Happened Because Its Employees Were Vibe Coding appeared first on Futurism.
