Hackers behind $6.3bn Binance heist ‘used malware and bogus job interviews’

Firm reveals details about how its cryptocurrency exchange was compromised, saying operation began in June

The hackers behind the $6.3bn (£4.7bn) Binance heist used bogus job interviews, malicious software and an internal AI tool, the company has revealed.

The world’s largest cryptocurrency exchange was compromised in an operation that began with an inadvertent download of malware in June, led to a recruitment scam in September and then a raid last week of “hot wallets” where billions of dollars worth of crypto-assets were taken.

The FBI has blamed North Korea for last week’s heist but Pyongyang, a prolific crypto-hacker, described the accusation as “absurd rhetoric” on Tuesday.

According to an update Binance released on Tuesday, the hackers got their first foothold in the summer when a company engineer inadvertently downloaded malware that exposed the employee’s role and that of others in the team that looked after Binance’s cryptowallet infrastructure.

A fake project director then contacted a different engineer on a legitimate job-hunting platform, leading to a first-round video interview with a sham HR representative and a second-round interview – on a chat app – with the “chief executive” of a fictitious company. It was during the second interview that the engineer was tricked into downloading malware on to his computer.

On 20 October, the attacker used the compromised computer plus an internal AI tool to gain control of the engineer’s system and that of a second wallet developer on the same team. Then on 29 October, the attacker used the second developer’s computer, using stolen ⁠credentials from the first engineer, and triggered a malicious script to ​launch the attack.

Binance said $2.85bn of the $6.34bn drained from cryptowallets in the attack had been frozen or intercepted.

Deepfake job interviews are a known part of North Korea’s cyber-arsenal, but normally from the other side of the process – where bogus IT professionals apply for jobs as a means of funnelling money back to Pyongyang.

“This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our users, partners and the wider industry,” Binance said in the update.

The FBI said on Saturday that North Korea was responsible for the hack.

But Kim Yo-jong, the influential sister of the North Korean leader Kim Jong-un, said on Tuesday that the allegations proved Washington remained hostile towards Pyongyang, according to North Korea’s state news agency, KCNA.

“The FBI is trying to brand the DPRK [the Democratic People’s Republic of Korea] as a ‘cybercriminal state,’ claiming that it obtained information that a hacking organisation ‘supported’ by the DPRK was involved in the incident,” KCNA quoted her as saying.

“But the US assertion ‌is absurd rhetoric and nothing new,” said Kim, a ruling party official.

“It is a grave political provocation against the DPRK that the US misleads international public opinion as if all the cybercrimes in different parts of the world are our deeds.”