The perpetrators of the $6.3 billion (£4.7 billion) Binance breach resorted to fake job interviews, harmful software, and an internal AI system, as disclosed by the company.
The leading cryptocurrency exchange faced a security breach that began with an accidental malware download in June, evolved into a recruitment scam in September, and culminated in a raid last week involving “hot wallets,” from which billions in crypto-assets were pilfered.
The FBI has attributed last week’s theft to North Korea; however, Pyongyang, known for its extensive cybercriminal activities, dismissed the claims as “laughable rhetoric” on Tuesday.
In a statement shared on Tuesday, Binance detailed that the hackers gained their initial access during the summer when one of its engineers unintentionally downloaded malware, which revealed the employee’s identity and that of other team members managing Binance’s wallet infrastructure.
A fraudulent project manager then reached out to another engineer on a legitimate job site, leading to an initial video interview with a fake HR agent, followed by a second interview—held on a messaging app—with the “CEO” of a nonexistent firm. During this latter conversation, the engineer was deceived into downloading malware onto their device.
On October 20, using the infected system along with an internal AI tool, the attacker took control of both the engineer’s and another wallet developer’s systems within the same team. By October 29, the assailant exploited the second developer’s computer, utilizing stolen credentials from the first engineer, and executed a malicious script to launch the attack.
According to Binance, approximately $2.85 billion out of the $6.34 billion siphoned from crypto wallets during the breach has either been frozen or intercepted.
Deepfake job interviews are a recognized tactic in North Korea’s cyber operations, though typically from the perspective of fraudulent IT job applicants aiming to redirect funds back to Pyongyang.
“This incident is unacceptable, and we extend our apologies for the anxiety, disruption, and uncertainty it has caused our users, partners, and the broader industry,” Binance stated in its update.
The FBI declared on Saturday that North Korea was behind the cyber breach.
after newsletter promotion
However, Kim Yo-jong, the notable sister of North Korean leader Kim Jong-un, commented on Tuesday that the allegations underscored Washington’s antagonistic stance towards Pyongyang, according to North Korea’s state-run news outlet, KCNA.
“The FBI is attempting to label the DPRK [Democratic People’s Republic of Korea] as a ‘cybercriminal state,’ alleging that it has proof that a hacking group ‘linked’ to the DPRK was part of the incident,” KCNA quoted her as saying.
“Such claims from the US are just ludicrous rhetoric and nothing more,” Kim, an official within the ruling party, stated.
“It is a serious political provocation against the DPRK that the US misrepresents to the global audience as if all cybercrimes occurring worldwide are attributable to us.”