Binance traces $6.3B hack to fake job interviews, compromised AI tool

Binance, the world's largest cryptocurrency exchange, reported on November 3 that hackers employed fake job interviews and an internal AI tool to execute a cyberattack resulting in the theft of over $6.34 billion in digital assets last week. The U.S. Federal Bureau of Investigation (FBI) has implicated North Korea in this incident, identifying the perpetrators as a North Korean hacking group known as TraderTraitor, a name previously associated with other cryptocurrency thefts.

According to Binance's latest findings, the multi-stage operation involved fake interviews and an internal AI tool, suspected to have begun as early as June. In September, a fraudulent recruiter on a job platform conducted video interviews and disseminated an assignment repository containing 0-day malware, which went unnoticed by endpoint tools, as revealed by the exchange's report.

On October 20, an internal AI tool was utilized by the attacker as a conduit to reach a container deployment token, subsequently deploying a container to initiate the attack, according to Binance. The exchange has blocked 57 suspected North Korea-linked threats this year.

Kim Yo-jong, the powerful sister of North Korean leader Kim Jong-un, categorically denied the FBI's findings, labeling it a "grave political provocation" against Pyongyang. The U.S. State Department reiterated its concerns over North Korea's use of cybercrime to finance its weapons programs. The issue of DPRK cybercrime, as North Korea is officially known, is a global problem affecting companies and jurisdictions worldwide, according to a U.S. State Department spokesman who commented on the department's stance regarding North Korea's latest claim.