One fake interview, four hours, US$6b gone: Binance explains the hack

On November 4, Binance unveiled a comprehensive investigation into a US$6 billion (RM24.4 billion) hack that targeted its cryptocurrency platform. The attack, which unfolded over approximately four hours on October 29, was traced back to North Korea-affiliated hackers, a claim the regime has vehemently denied. The investigation reveals how the cybercriminals employed deceptive tactics, including fake job interviews and malicious code, to perpetrate the heist.

To initiate the breach, the hackers began by targeting a platform engineer in June by duping him into downloading a virus-laden version of the popular programming software, Homebrew. Despite the cybersecurity team identifying and eliminating the malware, the attackers had already acquired sensitive information about the engineer and his colleagues.

In September, the cybercriminals approached another Binance engineer through a legitimate job-search platform, offering a job interview for a position within a fictitious company. Building rapport with the engineer through the sharing of social media content, they eventually persuaded him to download a test exercise as part of the interview process.

This exercise, in fact, harbored malware designed to bypass sophisticated obfuscation and evasion techniques, ultimately allowing the hackers to establish a connection with Binance's internal systems.

On October 20, the attackers, aided by an internal AI tool, gained control over software utilized by two other engineers. Just nine days later, they triggered the malicious code that set the hack in motion. At present, around US$2.85 billion (RM11.6 billion) of the stolen assets has been frozen, preventing the attackers from utilizing or converting the funds into another currency.