‘가짜 면접’에 내부 AI까지 뚫렸다…바이낸스 8조원 해킹 전말

The world's largest virtual asset exchange, Binance, has revealed the results of a 8 trillion won hacking investigation. The attackers infiltrated the system by posing as recruiters, gaining access to employees through fake job interviews and malicious code. According to reports from AFP and Bloomberg, Binance suffered a hacking incident on March 29, losing around $63.4 million (approximately 8.5 billion won) in cryptocurrency in just 4 hours.

The U.S. Federal Bureau of Investigation (FBI) attributed the attack to North Korean hackers, but North Korea denied involvement. The preparatory work for the attack began in June of the previous year. An engineer unwittingly downloaded malicious software during the installation process, and the attackers obtained information about the targeted employee and colleagues responsible for handling virtual asset funds.

Later, another engineer was targeted by posing as a project manager from a recruitment platform. The attackers lured the engineer into a virtual interview with the highest-ranking executive of the "phantom company," where they were given a malicious file to complete a programming task. Once the malicious code infiltrated the computer, it compromised parts of the development tools and, after a delay, managed to access Binance's internal AI tools.

On September 20, the attackers used this system to gain control of two engineers' computers responsible for developing the cryptocurrency wallet. Binance CEO Richard Teng acknowledged that it was "not a single mistake or breach, but a multi-month attack." However, Binance did not disclose the type or specific method of exploitation of the internal AI tools.

As of now, about half of the stolen cryptocurrency, 28.5 million won, has been frozen or blocked. Binance has recovered and frozen roughly 98% of the losses using its own funds and insurance. Following the incident, Binance suspended all withdrawals for about two days before gradually resuming them. The company is also pursuing security enhancement measures, such as rebuilding damaged infrastructure and developing a new internal AI tool.