Binance confirmed that North Korean hackers stole a record $6.3 billion in cryptocurrency last week through a months-long social engineering campaign. The hackers posed as recruiters and contacted a software engineer on Binance's wallet team, conducting fake interviews before instructing the engineer to download a malicious coding assignment. When opened, the assignment compromised the engineer's work laptop with code that Binance's security tools failed to detect.
From that foothold, the hackers accessed an internal tool to take over computers belonging to two other wallet engineers. One of those engineers had months earlier downloaded a tampered app containing password-stealing malware after searching for software online. Using the stolen credentials, the hackers reached a third engineer whose access allowed them to control systems managing billions of dollars in crypto.
The FBI and blockchain investigators have attributed the heist to North Korea, which has been accused of cryptocurrency thefts to fund its nuclear weapons program. Binance said it faced at least 57 suspected attacks from North Korea and described the country as a "persistent threat posed by state-sponsored actors targeting the cryptocurrency industry."
Researchers have warned for years that North Korean hackers pose as venture capitalists, investors, and recruiters using stolen American identities. Some half of all intrusions at U.S. tech companies last year were attributed to North Koreans posing as remote IT workers and fake recruiters, according to the article.
Binance stated the attack "should not have happened" and said it has improved network security and brought in cybersecurity experts to review the incident. The company declined to answer questions about how it prevents unauthorized software from running on employee laptops or whether it had undergone third-party cybersecurity audits before the hack.