The preliminary report on the $6.3 billion theft from Binance @binancezh is out. Another social engineering infiltration.
It started when Engineer B used a company computer during a job interview after switching jobs—and even downloaded third-party code. How much more can they dock from his performance review? 🤡
How the theft happened:
In June, Wallet Operations Engineer A searched for an AI coding tool and downloaded a tampered version of Homebrew, exposing the team’s information;
In September, Engineer B was invited to an interview by a fake recruiter. They went through the whole routine: a real video call with HR, followed by a second interview with a fake CEO. Finally, they asked him to run a “coding challenge” on his work computer, and the malware secretly replaced pyenv;
On October 20, hackers used B’s computer as a starting point and leveraged Binance’s internal AI tools to take control of the computers belonging to Wallet Engineers A and C;
On October 29, the hackers accessed C’s computer and used A’s deployment permissions to make calls to the signing service. That’s how the hot-wallet funds were transferred out.
North Korean hackers really are everywhere.
From now on, when exchange employees go to interviews, should they first make the interviewer say, “Kim Jong-un is **”? 🤣
It started when Engineer B used a company computer during a job interview after switching jobs—and even downloaded third-party code. How much more can they dock from his performance review? 🤡
How the theft happened:
In June, Wallet Operations Engineer A searched for an AI coding tool and downloaded a tampered version of Homebrew, exposing the team’s information;
In September, Engineer B was invited to an interview by a fake recruiter. They went through the whole routine: a real video call with HR, followed by a second interview with a fake CEO. Finally, they asked him to run a “coding challenge” on his work computer, and the malware secretly replaced pyenv;
On October 20, hackers used B’s computer as a starting point and leveraged Binance’s internal AI tools to take control of the computers belonging to Wallet Engineers A and C;
On October 29, the hackers accessed C’s computer and used A’s deployment permissions to make calls to the signing service. That’s how the hot-wallet funds were transferred out.
North Korean hackers really are everywhere.
From now on, when exchange employees go to interviews, should they first make the interviewer say, “Kim Jong-un is **”? 🤣
