A fake job interview at Binance opened the door to a $6.3 billion theft

In September, a Binance software engineer receives a message on a job-search platform. Their profile mentions their experience at Binance. The contact claims to be a project director at a company that does not exist. On October 29, about $6.34 billion in cryptocurrency leaves the platform's wallets.

Binance published its report on the theft on November 3. According to Fortune, it is the largest theft in the history of cryptocurrencies. The FBI had attributed it to TraderTraitor, a North Korean state-backed group also tracked as Lazarus, BleepingComputer points out. Binance itself does not tie the compromise of its employees to a specific campaign. Its account mainly shows how the hackers moved from one workstation to the next, all the way to the service that signs transactions.

A coding exercise that hid spyware

The fake recruiter first sets up a live video interview with a person presented as being in charge of human resources. To gain the engineer's trust, that person shares a social media account filled with personal photos and videos. A second contact, presented as the CEO of the fictitious company, then asks the engineer to download a programming exercise from an online code repository.

The code installs custom-built malware. Endpoint protection tools did not detect it, Binance acknowledges. On the engineer's Mac, it replaces a legitimate program, pyenv, installed through the Homebrew package manager, then runs commands sent by a server controlled by the hackers.

A first route had already been used in June, according to the report. While searching online for an AI programming tool, an engineer on the wallet operations team had downloaded a tampered version of Homebrew (Fortune mentions an ad). Binance spotted the anomaly and replaced the employee's device, but too late. The hackers had learned that employee's role and identified other colleagues who managed the company's wallets.

The role of an internal AI tool, still unclear

On October 20, the attackers take a decisive step. From the compromised computer, they “used an internal AI tool” to take control of two other members of the wallet team, according to the report cited by Fortune. On one of their workstations, they find an authorization token that allows software to be deployed on the infrastructure. The published accounts do not say how the AI tool was hijacked.

On October 29, this access lets them deploy a malicious script, reach the wallet signing service and move billions across several blockchains. Even after withdrawals were suspended, they keep draining funds by abusing an Ethereum authorization mechanism called EIP-7702.

Binance says all customer funds are safe. It says it had rebuilt 98% of the stolen assets as of October 31, using its reserves and other sources. About $2.85 billion had been frozen or intercepted as of November 3, according to BleepingComputer. Fortune, for its part, mentions about $2.5 billion recovered after Tether and Circle froze stablecoins. “This should not have happened,” writes the company, which apologizes.

Lessons for other companies

At the start, there was no spectacular vulnerability: a tampered development tool, an engineer approached about a job, an exercise to download, a workstation with broad access. A spokesperson told Fortune that employees who do not hold a public-facing role should not maintain a LinkedIn profile, without saying whether the engineer had broken that rule. A few habits limit this type of risk:

• ban the execution of recruitment exercises or code received from strangers on a work computer;
• install development tools from approved sources, never from an ad;
• leave no long-lived deployment token on a workstation and prefer temporary access tied to strong authentication;
• set limits on what internal AI tools can do with employees' accounts;
• require several independent human approvals for any sensitive operation.

Binance says it has foiled 57 suspected North Korea-linked attempts since the start of the year. North Korea is a country whose hackers keep refining their tools. The company has asked independent firms to verify its findings. Their opinion, and details on the hijacked AI tool, are still pending.