Binance Suffers $6.3 Billion Hack Through Sophisticated Tactics
A group of hackers used social engineering techniques to infiltrate Binance's systems through an employee who inadvertently downloaded malware in June, allowing them to gain access to sensitive information.
Binance has shed light on the events leading up to the massive $6.3 billion heist it suffered last week. The hackers used a combination of sophisticated tactics and social engineering techniques to infiltrate the company's systems.
The breach began in June when an employee inadvertently downloaded malware, which exposed sensitive information about their role within Binance's team responsible for its cryptowallet infrastructure. This initial compromise allowed the attackers to gain access to more areas of the system over time.
A fake job opportunity was presented to a different engineer through a legitimate job-hunting platform, leading to a video interview with a sham HR representative. The engineer was then invited to a second-round interview via a chat app, where they interacted with the "chief executive of a fictitious company.
The hackers' goal was to gain the trust of Binance's employees and extract sensitive information from them. They achieved this through a series of carefully crafted interactions that culminated in the engineer downloading malware onto their computer.
Binance has acknowledged that its internal AI tool was also exploited by the attackers, who used it to further compromise the company's systems. The full extent of the damage is still being assessed, but it is clear that the hackers' tactics were highly sophisticated and successful.
The hackers' use of compromised computers and internal AI tools allowed them to gain control of two wallet developers' systems on October 20th, setting the stage for the subsequent attack. This exploitation of vulnerabilities enabled the attackers to access sensitive information and prepare for their next move. The second developer's computer was used on October 29th to trigger a malicious script that launched the attack.
Binance has reported that $2.85 billion of the total $6.34 billion drained from cryptowallets during the attack has been frozen or intercepted, suggesting some measure of success in mitigating the damage. The remaining funds are still being assessed, and it is clear that the hackers' tactics were highly sophisticated.
North Korea's cyber arsenal includes deepfake job interviews as a means of funneling money back to Pyongyang, but this time around, the tactic was used by attackers to gain access to sensitive systems. Binance acknowledged in an update that the attack should not have happened and apologized for the concern and disruption it caused. The company expressed regret for the uncertainty it brought to users, partners, and the wider industry.
The FBI attributed the hack to North Korea on Saturday, while Kim Yo-jong, sister of the North Korean leader, responded by saying the allegations proved Washington's continued hostility towards Pyongyang.
The Democratic People's Republic of Korea has dismissed claims by the FBI that it was involved in a $6.3 billion hack on Binance. According to KCNA, Kim Yo-jong, a ruling party official and sister of the North Korean leader, called the allegations absurd rhetoric" that is nothing new.
Kim argued that Washington's assertion is a grave political provocation against Pyongyang, attempting to mislead international public opinion into believing that all cybercrimes worldwide are committed by the DPRK. The statement from Kim concludes with a stark message about the US motives behind the accusations.
Facts based on reporting originally published by The Guardian Business.
You may republish this story, in full or in part, if you credit Noti Group and link to it (licence CC BY 4.0). Photos are not included.
