In September, a software engineer for the cryptocurrency exchange Binance got an interview offer for a new opportunity.
The first interview, live by video, seemed above board. So did the second, conducted on a popular social chat app, where the Binance engineer spoke with his prospective new employer’s purported CEO. Then came time for a test — a standard feature in technical interviews — where the engineer was asked to download code onto his work computer.
That code, Binance said Tuesday, included malware that wormed its way into the exchange’s systems, evaded its security tools and eventually led to a record-breaking $6.3 billion hack last week that sent the exchange scrambling to cover users’ losses.
Binance released the first concrete details of how hackers breached its systems Tuesday after several days of investigation, describing the bogus job interview as one of several components.
The FBI and third-party cryptocurrency security firms have attributed the heist to a state North Korean hacker group.
North Korea, meanwhile, has denied its involvement in the hack, as it has in other prominent cybercrime instances. Kim Yo Jong, the powerful sister of leader Kim Jong Un, accused the United States of “blindly linking” the crime to her country.
The job interview technique has been used by North Korean hackers in the past. In September, the FBI and government agencies in Japan, Germany and Australia issued an advisory that North Korean actors were targeting software developers and IT professionals and had infected at least 30,000 devices in more than 100 countries.
Phishing is a common starting point for hacks. More than 90 percent of successful cyberattacks start with a phishing email, according to the Cybersecurity and Infrastructure Security Agency.
But the Binance hackers were going after far more than an Instagram password or credit card number, and Binance has said the hack was much more sophisticated than just a malicious link in an email.
“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in its initial report.
During the software engineer’s first live interview, the company said the purported job interviewer shared a social media account with personal videos and photos that was “more advanced and deceptive than previously seen social engineering approaches.”
The hackers got their first glimpse into Binance in June, the company said, after another software engineer downloaded malicious code hiding inside a common software installation utility while trying to set up a popular artificial intelligence coding tool. Binance said its security team detected the anomaly, replaced the second engineer’s laptop and rotated security credentials to ensure its systems were not further compromised.
But the hackers had figured out that engineer’s role — as part of the exchange’s “wallet” infrastructure team, which manages accounts — and other people that employee worked with.
The malware on the first engineer’s laptop was also sophisticated, the company said, and took steps to conceal bad activity and remove traces of its work. Once that engineer’s work laptop was compromised, the attackers used an internal AI tool on Oct. 20 to gain control over two other employees’ laptops — including the engineer who had been temporarily compromised in June.
Undetected thus far by Binance’s security, they launched the attack Thursday and cleared billions from the exchange in about 20 minutes.
Binance said that it had detected and prevented 57 other suspected cyberthreat cases linked to North Korea this year. It has begun the process of recovering user funds using its own reserves and said Tuesday it had replenished 98 percent of the impacted assets.
The post How malware and a bogus job interview let attackers nab $6.3B from Binance appeared first on Washington Post.
