The platform said the attackers began the operation in June by downloading a virus-infected program and, months later, contacted another employee through a job platform to trick them into downloading malware
#Binance reveals that one of its engineers downloaded malware that led to the theft of $6 billion
#Binance revealed on Tuesday that one of its employees, tricked by hackers with a fake job interview, downloaded malware that led to the theft of more than $6 billion in cryptocurrency from its platform, considered the biggest heist in the history of the industry.
The platform said it had already reimbursed 98% of the stolen assets using its own funds. The remaining 2% was in cryptocurrencies that are harder to acquire because they are scarce.
According to the company, the hackers made their first move in June, four months before the theft.
The hackers got an engineer at the platform to download a version of a programming tool widely used in the industry (Homebrew) that contained a virus.
Although the company’s cybersecurity teams detected and removed the virus, the hackers obtained the data of the engineer who downloaded it and of other colleagues at the platform.
In September, they approached another Binance engineer through a job platform, offering an interview and getting him to download malware using “sophisticated techniques,” the platform said.
The malware was key to the success of the hack and allowed the cybercriminals to connect to the platform’s internal systems.
On October 20, the attackers used the access they had obtained and an internal AI tool to take control of the software used by two other engineers.
Nine days later, they activated the malicious code that launched the attack, which the FBI says is linked to North Korean authorities.
Pyongyang, through the sister of leader Kim Jong Un, called the accusation “absurd rhetoric.”
About $2.85 billion of the stolen funds were frozen, according to Binance, meaning the attackers could not use that amount to exchange for other currencies.
Binance is the world’s largest cryptocurrency exchange by daily trading volume. News of the cyberattack caused the prices of most of these currencies to plunge.
