Binance says hackers used fake job interviews and an internal AI tool to pull off the $6.3 billion heist

A sophisticated North Korean hacking group known as "TraderTraitor" executed a massive $6.3 billion cyber heist on Binance over several months, according to a company post-mortem. The attack began with a search engine ad delivering malware that tricked a developer into downloading a compromised installer in June. This initial breach was detected by Binance's security teams, who promptly replaced the infected device.

However, the second assault, which occurred in September, was far more sophisticated. An engineer was targeted by an individual who posed as a potential employer, conducting multiple interviews and building trust through social media interactions. Eventually, the fraudster convinced the engineer to download a fake interview assignment, which was actually malware.

Binance's security systems failed to detect this second attack, which replaced the developer's legitimate pyenv executable with a malicious version, granting the attackers backdoor access. By October 20th, the hackers had gained control over the compromised engineer's wallets and another third employee's account. Utilizing Binance's internal AI tool, the attackers managed to log into the third employee's computer on October 29th and executed their attack.

Binance was unable to halt the transactions, which occurred two hours after the unauthorized transfers. CEO Richard Teng assured that no individual user would bear the loss, with approximately $2.85 billion in stolen assets frozen or intercepted. The company has successfully prevented 57 suspected North Korea-linked cyber threat cases and has replenished about 98% of the impacted tokens.

However, the specific mechanisms of the internal AI tool used by the attackers and why Binance's security measures failed during the second attack remain unclear.